git.tremily.us Git - gentoo.git/blob

   1 From 73e4abb24a936014727924d8b0b2965edfc117dd Mon Sep 17 00:00:00 2001
   2 From: Jouni Malinen <jouni@qca.qualcomm.com>
   3 Date: Fri, 4 Mar 2016 18:46:41 +0200
   4 Subject: [PATCH 2/5] Reject psk parameter set with invalid passphrase
   5  character
   6
   7 WPA/WPA2-Personal passphrase is not allowed to include control
   8 characters. Reject a passphrase configuration attempt if that passphrase
   9 includes an invalid passphrase.
  10
  11 This fixes an issue where wpa_supplicant could have updated the
  12 configuration file psk parameter with arbitrary data from the control
  13 interface or D-Bus interface. While those interfaces are supposed to be
  14 accessible only for trusted users/applications, it may be possible that
  15 an untrusted user has access to a management software component that
  16 does not validate the passphrase value before passing it to
  17 wpa_supplicant.
  18
  19 This could allow such an untrusted user to inject up to 63 characters of
  20 almost arbitrary data into the configuration file. Such configuration
  21 file could result in wpa_supplicant trying to load a library (e.g.,
  22 opensc_engine_path, pkcs11_engine_path, pkcs11_module_path,
  23 load_dynamic_eap) from user controlled location when starting again.
  24 This would allow code from that library to be executed under the
  25 wpa_supplicant process privileges.
  26
  27 Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
  28 ---
  29  wpa_supplicant/config.c | 6 ++++++
  30  1 file changed, 6 insertions(+)
  31
  32 diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
  33 index b1c7870..fdd9643 100644
  34 --- a/wpa_supplicant/config.c
  35 +++ b/wpa_supplicant/config.c
  36 @@ -478,6 +478,12 @@ static int wpa_config_parse_psk(const struct parse_data *data,
  37                 }
  38                 wpa_hexdump_ascii_key(MSG_MSGDUMP, "PSK (ASCII passphrase)",
  39                                       (u8 *) value, len);
  40 +               if (has_ctrl_char((u8 *) value, len)) {
  41 +                       wpa_printf(MSG_ERROR,
  42 +                                  "Line %d: Invalid passphrase character",
  43 +                                  line);
  44 +                       return -1;
  45 +               }
  46                 if (ssid->passphrase && os_strlen(ssid->passphrase) == len &&
  47                     os_memcmp(ssid->passphrase, value, len) == 0) {
  48                         /* No change to the previously configured value */
  49 --
  50 1.9.1
  51