Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 596042 (CVE-2015-5310, CVE-2015-5315, CVE-2015-5316, CVE-2016-4477) - <net-wireless/wpa_supplicant-2.6: Multiple vulnerabilities (CVE-2016-4476)
Summary: <net-wireless/wpa_supplicant-2.6: Multiple vulnerabilities (CVE-2016-4476)
Status: RESOLVED FIXED
Alias: CVE-2015-5310, CVE-2015-5315, CVE-2015-5316, CVE-2016-4477
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://w1.fi/cgit/hostap/plain/wpa_su...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks: 590050
  Show dependency tree
 
Reported: 2016-10-03 13:40 UTC by Thomas Deutschmann
Modified: 2017-02-02 07:33 UTC (History)
2 users (show)

See Also:
Package list:
=net-wireless/wpa_supplicant-2.6
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann gentoo-dev Security 2016-10-03 13:40:49 UTC
wpa_supplicant unauthorized WNM Sleep Mode GTK control (CVE-2015-5310)

A vulnerability in wpa_supplicant was found in WMM Sleep Mode Response
frame processing in a case where the association uses RSN (WPA2-Personal
or WPA2-Enterprise), but does not use management frame protection (MFP,
also known as PMF = protected management frames). This WNM Sleep Mode
mechanism was not designed to be used without management frame
protection, but there was no explicit check for that in wpa_supplicant.

wpa_supplicant accepted the updated GTK keys from this frame regardless
of whether management frame protection was negotiated for the
association. This may result in an unauthenticated, injected frame being
able to replace the GTK (the key used to protected broadcast and
multicast Data frames).

This vulnerability can be used to perform broadcast/multicast packet
injection and denial of service (prevent authorized broadcast/multicast
packets from being accepted) attacks by an attacker that is within radio
range of the station devices.


Vulnerable versions/configurations

wpa_supplicant v2.0-v2.5 with CONFIG_WNM=y the build configuration
(wpa_supplicant/.config) and a driver that sends WNM Action frames to
user space for processing. For example, most cfg80211/mac80211-based
drivers do this. However, some drivers do not seem to send the WNM Sleep
Mode Response frame to user space even though they are reporting some
other WNM Action frames. When wpa_supplicant is used with such a driver,
it may not be possible to trigger this vulnerability.

http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt



EAP-pwd last fragment validation (CVE-2015-5315)

A vulnerability was found in EAP-pwd server and peer implementation used
in hostapd and wpa_supplicant, respectively. When an incoming EAP-pwd
message is fragmented, the remaining reassembly buffer length was not
checked for the last fragment (but was checked for other
fragments). This allowed a suitably constructed last fragment frame to
try to add extra data that would go beyond the buffer. The length
validation code in wpabuf_put_data() prevents an actual buffer write
overflow from occurring, but this results in process termination.

For hostapd used with an internal EAP server and EAP-pwd enabled in the
runtime configuration, this could allow a denial of service attack by an
attacker within radio range of the AP device.

For hostapd used as a RADIUS server with EAP-pwd enabled in the runtime
configuration, this could allow a denial of service attack by an
attacker within radio range of any AP device that is authorized to use
the RADIUS server.

For wpa_supplicant with EAP-pwd enabled in a network configuration
profile, this could allow a denial of service attack by an attacker
within radio range.


Vulnerable versions/configurations

hostapd v2.0-v2.5 with CONFIG_EAP_PWD=y in the build configuration
(hostapd/.config) and EAP-pwd authentication server enabled in runtime
configuration.

wpa_supplicant v2.0-v2.5 with CONFIG_EAP_PWD=y in the build
configuration (wpa_supplicant/.config) and EAP-pwd enabled in a network
profile at runtime.

http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txt



EAP-pwd unexpected Confirm message processing (CVE-2015-5316)

A vulnerability was found in EAP-pwd peer implementation used in
wpa_supplicant. If an EAP-pwd Confirm message is received unexpectedly
before the Identity exchange, the error path processing ended up
dereferencing a NULL pointer and terminating the process.

For wpa_supplicant with EAP-pwd enabled in a network configuration
profile, this could allow a denial of service attack by an attacker
within radio range.


Vulnerable versions/configurations

wpa_supplicant v2.3-v2.5 with CONFIG_EAP_PWD=y in the build
configuration (wpa_supplicant/.config) and EAP-pwd enabled in a network
profile at runtime.

http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txt




WPS configuration update vulnerability with malformed passphrase (CVE-2016-4476)

A vulnerability was found in how hostapd and wpa_supplicant writes the
configuration file update for the WPA/WPA2 passphrase parameter. If this
parameter has been updated to include control characters either through
a WPS operation (CVE-2016-4476) or through local configuration change
over the wpa_supplicant control interface (CVE-2016-4477), the resulting
configuration file may prevent the hostapd and wpa_supplicant from
starting when the updated file is used. In addition for wpa_supplicant,
it may be possible to load a local library file and execute code from
there with the same privileges under which the wpa_supplicant process
runs.

The WPS trigger for this requires local user action to authorize the WPS
operation in which a new configuration would be received. The attacker
would also need to be in radio range of the device or have access to the
IP network to act as a WPS External Registrar. Such an attack could
result in denial of service by not allowing hostapd or wpa_supplicant to
start after they have been stopped.

The local configuration update through the control interface SET_NETWORK
command could allow privilege escalation for the local user to run code
from a locally stored library file under the same privileges as the
wpa_supplicant process has. The assumption here is that a not fully
trusted user/application might have access through a connection manager
to set network profile parameters like psk, but would not have access to
set other configuration file parameters. If the connection manager in
such a case does not filter out control characters from the psk value,
it could have been possible to practically update the global parameters
by embedding a newline character within the psk value. In addition, the
untrusted user/application would need to be able to install a library
file somewhere on the device from where the wpa_supplicant process has
privileges to load the library.

Similarly to the SET_NETWORK case, if a connection manager exposes
access to the SET_CRED or SET commands, similar issue with newline
characters can exist as those commands do not filter out control
characters from the value.

It should also be noted that providing unlimited access to the
wpa_supplicant control interface would allow arbitrary SET commands to
be issued. Such unlimited access should not be provided to untrusted
users/applications.


Vulnerable versions/configurations

For the local control interface attack vector (CVE-2016-4477):

wpa_supplicant v0.4.0-v2.5 with control interface enabled

update_config=1 must have been enabled in the configuration file.


For the WPS attack vector (CVE-2016-4476):

wpa_supplicant v0.6.7-v2.5 with CONFIG_WPS build option enabled
hostapd v0.6.7-v2.5 with CONFIG_WPS build option enabled

WPS needs to be enabled in the runtime operation and the WPS operation
needs to have been authorized by the local user over the control
interface. For wpa_supplicant, update_config=1 must have been enabled in
the configuration file.

http://w1.fi/security/2016-1/psk-parameter-config-update.txt



Configuration update vulnerability with malformed parameters set over the local control interface (CVE-2016-4477)

A vulnerability was found in how hostapd and wpa_supplicant writes the
configuration file update for the WPA/WPA2 passphrase parameter. If this
parameter has been updated to include control characters either through
a WPS operation (CVE-2016-4476) or through local configuration change
over the wpa_supplicant control interface (CVE-2016-4477), the resulting
configuration file may prevent the hostapd and wpa_supplicant from
starting when the updated file is used. In addition for wpa_supplicant,
it may be possible to load a local library file and execute code from
there with the same privileges under which the wpa_supplicant process
runs.

The WPS trigger for this requires local user action to authorize the WPS
operation in which a new configuration would be received. The attacker
would also need to be in radio range of the device or have access to the
IP network to act as a WPS External Registrar. Such an attack could
result in denial of service by not allowing hostapd or wpa_supplicant to
start after they have been stopped.

The local configuration update through the control interface SET_NETWORK
command could allow privilege escalation for the local user to run code
from a locally stored library file under the same privileges as the
wpa_supplicant process has. The assumption here is that a not fully
trusted user/application might have access through a connection manager
to set network profile parameters like psk, but would not have access to
set other configuration file parameters. If the connection manager in
such a case does not filter out control characters from the psk value,
it could have been possible to practically update the global parameters
by embedding a newline character within the psk value. In addition, the
untrusted user/application would need to be able to install a library
file somewhere on the device from where the wpa_supplicant process has
privileges to load the library.

Similarly to the SET_NETWORK case, if a connection manager exposes
access to the SET_CRED or SET commands, similar issue with newline
characters can exist as those commands do not filter out control
characters from the value.

It should also be noted that providing unlimited access to the
wpa_supplicant control interface would allow arbitrary SET commands to
be issued. Such unlimited access should not be provided to untrusted
users/applications.


Vulnerable versions/configurations

For the local control interface attack vector (CVE-2016-4477):

wpa_supplicant v0.4.0-v2.5 with control interface enabled

update_config=1 must have been enabled in the configuration file.


For the WPS attack vector (CVE-2016-4476):

wpa_supplicant v0.6.7-v2.5 with CONFIG_WPS build option enabled
hostapd v0.6.7-v2.5 with CONFIG_WPS build option enabled

WPS needs to be enabled in the runtime operation and the WPS operation
needs to have been authorized by the local user over the control
interface. For wpa_supplicant, update_config=1 must have been enabled in
the configuration file.

http://w1.fi/security/2016-1/psk-parameter-config-update.txt
Comment 1 Thomas Deutschmann gentoo-dev Security 2016-10-03 13:49:17 UTC
@ maintainer(s): Upstream has released v2.6 which contains fixes for the reported vulnerabilities. After the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 2 Bjarke Istrup Pedersen (RETIRED) gentoo-dev 2016-10-05 17:04:00 UTC
Bumped to 2.6, please stabilize and remove the old versions.
Comment 3 Thomas Deutschmann gentoo-dev Security 2016-10-05 17:11:02 UTC
@ Maintainer: Thank you for your work!

@ Arches,

please test and mark stable: =net-wireless/wpa_supplicant-2.6

Stable targets: amd64 arm ppc ppc64 x86
Comment 4 Jeroen Roovers gentoo-dev 2016-10-06 05:20:50 UTC
Stable for PPC64.
Comment 5 Agostino Sarubbo gentoo-dev 2016-10-07 08:59:56 UTC
amd64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2016-10-07 09:01:55 UTC
x86 stable
Comment 7 Markus Meier gentoo-dev 2016-10-18 19:49:01 UTC
arm stable
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2016-11-21 10:04:48 UTC
CVE-2016-4476 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4476):
  hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject
  \n and \r characters in passphrase parameters, which allows remote attackers
  to cause a denial of service (daemon outage) via a crafted WPS operation.
Comment 9 Agostino Sarubbo gentoo-dev 2017-01-15 15:59:44 UTC
ppc stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 10 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2017-01-16 03:47:20 UTC
GLSA Vote: No