oss-security - wpa_supplicant/hostapd: EAP-pwd message reassembly issue with unexpected fragment

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 18 Apr 2019 18:59:26 +0300
From: Jouni Malinen <j@...fi>
To: oss-security@...ts.openwall.com
Subject: wpa_supplicant/hostapd: EAP-pwd message reassembly issue with
 unexpected fragment

Published: April 18, 2019
Latest version available from: https://w1.fi/security/2019-5/

Vulnerability

EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant (EAP
peer) was discovered not to validate fragmentation reassembly state
properly for a case where an unexpected fragment could be received. This
could result in process termination due to NULL pointer dereference.

An attacker in radio range of a station device with wpa_supplicant
network profile enabling use of EAP-pwd could cause the wpa_supplicant
process to terminate by constructing unexpected sequence of EAP
messages. An attacker in radio range of an access point that points to
hostapd as an authentication server with EAP-pwd user enabled in runtime
configuration (or in non-WLAN uses of EAP authentication as long as the
attacker can send EAP-pwd messages to the server) could cause the
hostapd process to terminate by constructing unexpected sequence of EAP
messages.

Vulnerable versions/configurations

All hostapd and wpa_supplicant versions with EAP-pwd support
(CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled
in the runtime configuration) are vulnerable against the process
termination (denial of service) attack.

Possible mitigation steps

- Merge the following commits to wpa_supplicant/hostapd and rebuild:

  EAP-pwd peer: Fix reassembly buffer handling
  EAP-pwd server: Fix reassembly buffer handling

  These patches are available from https://w1.fi/security/2019-5/

- Update to wpa_supplicant/hostapd v2.8 or newer, once available

-- 
Jouni Malinen                                            PGP id EFC895FA

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.