[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 6 Feb 2021 17:17:57 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: wpa_supplicant P2P group information processing
vulnerability
Hi,
On Thu, Feb 04, 2021 at 01:09:32AM +0200, Jouni Malinen wrote:
> Published: February 4, 2021
> Latest version available from: https://w1.fi/security/2020-2/
>
>
> Vulnerability
>
> A vulnerability was discovered in how wpa_supplicant processing P2P
> (Wi-Fi Direct) group information from active group owners. The actual
> parsing of that information validates field lengths appropriately, but
> a copy of the secondary device types. This can result in writing
> attacker controlled data into the peer entry after the area assigned for
> the secondary device type. The overflow can result in corrupting
> pointers for heap allocations. This can result in an attacker within
> radio range of the device running P2P discovery being able to cause
> unexpected behavior, including termination of the wpa_supplicant process
> and potentially arbitrary code execution.
>
>
> Vulnerable versions/configurations
>
> wpa_supplicant v1.0-v2.9 with CONFIG_P2P build option enabled
>
> An attacker (or a system controlled by the attacker) needs to be within
> radio range of the vulnerable system to send a suitably constructed
> management frame that triggers a P2P peer device information to be
> created or updated.
>
>
> Acknowledgments
>
> This issue was discovered by fuzz testing of wpa_supplicant by Google's
> OSS-Fuzz.
>
> Possible mitigation steps
>
> - Merge the following commit to wpa_supplicant and rebuild it:
>
> P2P: Fix copying of secondary device types for P2P group client
>
> This patch is available from https://w1.fi/security/2020-2/
>
> - Update to wpa_supplicant v2.10 or newer, once available
>
> - Disable P2P (control interface command "P2P_SET disabled 1" or
> "p2p_disabled=1" in (each, if multiple interfaces used) wpa_supplicant
> configuration file)
>
> - Disable P2P from the build (remove CONFIG_P2P=y)
>From https://source.android.com/security/bulletin/2021-02-01
following/referencing to
https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0b60cb210510c68871c8d735285bc4915de3bd80
and the information on
https://bugzilla.redhat.com/show_bug.cgi?id=1925152 this looks that it
hs CVE-2021-0326 assigned.
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
