mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-28 11:43:25 +02:00
d7d5774529
A vulnerability was found in how a number of implementations can be triggered to reconfigure WPA/WPA2/RSN keys (TK, GTK, or IGTK) by replaying a specific frame that is used to manage the keys. Such reinstallation of the encryption key can result in two different types of vulnerabilities: disabling replay protection and significantly reducing the security of encryption to the point of allowing frames to be decrypted or some parts of the keys to be determined by an attacker depending on which cipher is used. This fixes: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088 Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
44 lines
1.6 KiB
Diff
44 lines
1.6 KiB
Diff
From 53c5eb58e95004f86e65ee9fbfccbc291b139057 Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <j@w1.fi>
|
|
Date: Fri, 22 Sep 2017 11:25:02 +0300
|
|
Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending
|
|
request
|
|
|
|
Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep
|
|
Mode Response if WNM-Sleep Mode has not been used') started ignoring the
|
|
response when no WNM-Sleep Mode Request had been used during the
|
|
association. This can be made tighter by clearing the used flag when
|
|
successfully processing a response. This adds an additional layer of
|
|
protection against unexpected retransmissions of the response frame.
|
|
|
|
Signed-off-by: Jouni Malinen <j@w1.fi>
|
|
---
|
|
wpa_supplicant/wnm_sta.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
|
|
index 1b3409c..67a07ff 100644
|
|
--- a/wpa_supplicant/wnm_sta.c
|
|
+++ b/wpa_supplicant/wnm_sta.c
|
|
@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
|
|
|
|
if (!wpa_s->wnmsleep_used) {
|
|
wpa_printf(MSG_DEBUG,
|
|
- "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association");
|
|
+ "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested");
|
|
return;
|
|
}
|
|
|
|
@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
|
|
return;
|
|
}
|
|
|
|
+ wpa_s->wnmsleep_used = 0;
|
|
+
|
|
if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
|
|
wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
|
|
wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
|
|
--
|
|
2.7.4
|
|
|