<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/13/2015 08:11 PM, Jussi Kukkonen
wrote:<br>
</div>
<blockquote
cite="mid:CAHiDW_HddeP2fLOCBWSG7=cfS0Zuaoh0gnW3nBpLTtjH62huRA@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">On 13 November 2015 at 13:08, Hongxu
Jia <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:hongxu.jia@windriver.com" target="_blank">hongxu.jia@windriver.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Backport
patch from <a moz-do-not-send="true"
href="http://w1.fi/security/2015-5/" rel="noreferrer"
target="_blank">http://w1.fi/security/2015-5/</a><br>
and rebase for wpa-supplicant 2.4</blockquote>
<div><br>
</div>
<div>There's a thread about upgrading master to 2.5 (which
should fix this) already.</div>
<div> </div>
<div>The patch probably still makes sense for jethro though.</div>
<div><br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Yes, you are right, the 2.5 don't need this, it makes sense for
jethro.<br>
<br>
//Hongxu<br>
<br>
<blockquote
cite="mid:CAHiDW_HddeP2fLOCBWSG7=cfS0Zuaoh0gnW3nBpLTtjH62huRA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div> - Jussi</div>
<div><br>
</div>
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex"> <br>
</blockquote>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Signed-off-by: Hongxu Jia <<a moz-do-not-send="true"
href="mailto:hongxu.jia@windriver.com">hongxu.jia@windriver.com</a>><br>
---<br>
<span class=""> ...load-length-validation-in-NDEF-record-par.patch
| 64 ++++++++++++++++++++++<br>
.../wpa-supplicant/<a moz-do-not-send="true"
href="http://wpa-supplicant_2.4.bb" rel="noreferrer"
target="_blank">wpa-supplicant_2.4.bb</a> |
1 +<br>
2 files changed, 65 insertions(+)<br>
create mode 100644
meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-NFC-Fix-payload-length-validation-in-NDEF-record-par.patch<br>
<br>
</span>diff --git
a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-NFC-Fix-payload-length-validation-in-NDEF-record-par.patch
b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-NFC-Fix-payload-length-validation-in-NDEF-record-par.patch<br>
new file mode 100644<br>
index 0000000..bc1d1e5<br>
--- /dev/null<br>
+++
b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-NFC-Fix-payload-length-validation-in-NDEF-record-par.patch<br>
@@ -0,0 +1,64 @@<br>
+From c13401c723a039971bcd91b3856d76c6041b15f2 Mon Sep 17
00:00:00 2001<br>
+From: Jouni Malinen <<a moz-do-not-send="true"
href="mailto:j@w1.fi">j@w1.fi</a>><br>
+Date: Fri, 13 Nov 2015 05:54:18 -0500<br>
+Subject: [PATCH] NFC: Fix payload length validation in
NDEF record parser<br>
+<br>
+It was possible for the 32-bit record->total_length
value to end up<br>
+wrapping around due to integer overflow if the longer
form of payload<br>
+length field is used and record->payload_length gets a
value close to<br>
+2^32. This could result in ndef_parse_record() accepting
a too large<br>
+payload length value and the record type filter reading
up to about 20<br>
+bytes beyond the end of the buffer and potentially
killing the process.<br>
+This could also result in an attempt to allocate close to
2^32 bytes of<br>
+heap memory and if that were to succeed, a buffer read
overflow of the<br>
+same length which would most likely result in the process
termination.<br>
+In case of record->total_length ending up getting the
value 0, there<br>
+would be no buffer read overflow, but record parsing
would result in an<br>
+infinite loop in ndef_parse_records().<br>
+<br>
+Any of these error cases could potentially be used for
denial of service<br>
+attacks over NFC by using a malformed NDEF record on an
NFC Tag or<br>
+sending them during NFC connection handover if the
application providing<br>
+the NDEF message to hostapd/wpa_supplicant did no
validation of the<br>
+received records. While such validation is likely done in
the NFC stack<br>
+that needs to parse the NFC messages before further
processing,<br>
+hostapd/wpa_supplicant better be prepared for any data
being included<br>
+here.<br>
+<br>
+Fix this by validating record->payload_length value in
a way that<br>
+detects integer overflow. (CID 122668)<br>
+<br>
+Signed-off-by: Jouni Malinen <<a
moz-do-not-send="true" href="mailto:j@w1.fi">j@w1.fi</a>><br>
+<br>
+Upstream-Status: Backport [from <a
moz-do-not-send="true"
href="http://w1.fi/security/2015-5/" rel="noreferrer"
target="_blank">http://w1.fi/security/2015-5/</a>]<br>
+Signed-off-by: Hongxu Jia <<a moz-do-not-send="true"
href="mailto:hongxu.jia@windriver.com">hongxu.jia@windriver.com</a>><br>
+---<br>
+ src/wps/ndef.c | 5 ++++-<br>
+ 1 file changed, 4 insertions(+), 1 deletion(-)<br>
+<br>
+diff --git a/src/wps/ndef.c b/src/wps/ndef.c<br>
+index d45dfc8..f7f729b 100644<br>
+--- a/src/wps/ndef.c<br>
++++ b/src/wps/ndef.c<br>
+@@ -48,6 +48,8 @@ static int ndef_parse_record(const u8
*data, u32 size,<br>
+ if (size < 6)<br>
+ return -1;<br>
+ record->payload_length = ntohl(*(u32
*)pos);<br>
++ if (record->payload_length > size
- 6)<br>
++ return -1;<br>
+ pos += sizeof(u32);<br>
+ }<br>
+<br>
+@@ -68,7 +70,8 @@ static int ndef_parse_record(const u8
*data, u32 size,<br>
+ pos += record->payload_length;<br>
+<br>
+ record->total_length = pos - data;<br>
+- if (record->total_length > size)<br>
++ if (record->total_length > size ||<br>
++ record->total_length <
record->payload_length)<br>
+ return -1;<br>
+ return 0;<br>
+ }<br>
+--<br>
+1.9.1<br>
+<br>
diff --git a/meta/recipes-connectivity/wpa-supplicant/<a
moz-do-not-send="true"
href="http://wpa-supplicant_2.4.bb" rel="noreferrer"
target="_blank">wpa-supplicant_2.4.bb</a>
b/meta/recipes-connectivity/wpa-supplicant/<a
moz-do-not-send="true"
href="http://wpa-supplicant_2.4.bb" rel="noreferrer"
target="_blank">wpa-supplicant_2.4.bb</a><br>
index a124cf2..6e4d028 100644<br>
--- a/meta/recipes-connectivity/wpa-supplicant/<a
moz-do-not-send="true"
href="http://wpa-supplicant_2.4.bb" rel="noreferrer"
target="_blank">wpa-supplicant_2.4.bb</a><br>
+++ b/meta/recipes-connectivity/wpa-supplicant/<a
moz-do-not-send="true"
href="http://wpa-supplicant_2.4.bb" rel="noreferrer"
target="_blank">wpa-supplicant_2.4.bb</a><br>
@@ -32,6 +32,7 @@ SRC_URI = "<a moz-do-not-send="true"
href="http://hostap.epitest.fi/releases/wpa_supplicant-$%7BPV%7D.tar.gz"
rel="noreferrer" target="_blank">http://hostap.epitest.fi/releases/wpa_supplicant-${PV}.tar.gz</a>
\<br>
<a class="moz-txt-link-freetext" href="file://0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch">file://0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch</a>
\<br>
<a class="moz-txt-link-freetext" href="file://0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch">file://0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch</a>
\<br>
<a class="moz-txt-link-freetext" href="file://0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch">file://0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch</a>
\<br>
+
<a class="moz-txt-link-freetext" href="file://0001-NFC-Fix-payload-length-validation-in-NDEF-record-par.patch">file://0001-NFC-Fix-payload-length-validation-in-NDEF-record-par.patch</a>
\<br>
"<br>
SRC_URI[md5sum] = "f0037dbe03897dcaf2ad2722e659095d"<br>
SRC_URI[sha256sum] =
"058dc832c096139a059e6df814080f50251a8d313c21b13364c54a1e70109122"<br>
<div class="HOEnZb">
<div class="h5">--<br>
1.9.1<br>
<br>
--<br>
_______________________________________________<br>
Openembedded-core mailing list<br>
<a moz-do-not-send="true"
href="mailto:Openembedded-core@lists.openembedded.org">Openembedded-core@lists.openembedded.org</a><br>
<a moz-do-not-send="true"
href="http://lists.openembedded.org/mailman/listinfo/openembedded-core"
rel="noreferrer" target="_blank">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</blockquote>
<br>
</body>
</html>