oss-security - CVE Request: Linux kernel mac80211 plain text leak

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 6 Nov 2014 17:33:35 +0100
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE Request: Linux kernel mac80211 plain text leak

Hi,

While searching for another kernel issue I found this gem which apparently has no CVE yet:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=338f977f4eb441e69bb9a46eaa0ac715c931a67f

I think it needs a CVE.

Ciao, Marcus

commit 338f977f4eb441e69bb9a46eaa0ac715c931a67f
Author: Johannes Berg <johannes.berg@...el.com>
Date:   Sat Feb 1 00:16:23 2014 +0100

    mac80211: fix fragmentation code, particularly for encryption

    The "new" fragmentation code (since my rewrite almost 5 years ago)
    erroneously sets skb->len rather than using skb_trim() to adjust
    the length of the first fragment after copying out all the others.
    This leaves the skb tail pointer pointing to after where the data
    originally ended, and thus causes the encryption MIC to be written
    at that point, rather than where it belongs: immediately after the
    data.

    The impact of this is that if software encryption is done, then
     a) encryption doesn't work for the first fragment, the connection
        becomes unusable as the first fragment will never be properly
        verified at the receiver, the MIC is practically guaranteed to
        be wrong
     b) we leak up to 8 bytes of plaintext (!) of the packet out into
        the air

    This is only mitigated by the fact that many devices are capable
    of doing encryption in hardware, in which case this can't happen
    as the tail pointer is irrelevant in that case. Additionally,
    fragmentation is not used very frequently and would normally have
    to be configured manually.

    Fix this by using skb_trim() properly.

    Cc: stable@...r.kernel.org
    Fixes: 2de8e0d999b8 ("mac80211: rewrite fragmentation")
    Reported-by: Jouni Malinen <j@...fi>
    Signed-off-by: Johannes Berg <johannes.berg@...el.com>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.