aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt3.patch
diff options
context:
space:
mode:
authorMark H Weaver <mhw@netris.org>2016-05-03 09:33:47 -0400
committerMark H Weaver <mhw@netris.org>2016-05-03 09:39:59 -0400
commit0a17fd7c0b82ac315b68c88e6f206e0051dcd661 (patch)
tree7419f559b6ffaa284e478c153542e2ccaf8883c1 /gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt3.patch
parent4c6aa73b8f9a16130ae9546efd8fdcb99fc034d9 (diff)
downloadguix-0a17fd7c0b82ac315b68c88e6f206e0051dcd661.tar
guix-0a17fd7c0b82ac315b68c88e6f206e0051dcd661.tar.gz
gnu: wpa-supplicant: Add fixes for CVE-2016-{4476,4477}.
* gnu/packages/patches/wpa-supplicant-CVE-2016-4476.patch, gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt1.patch, gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt2.patch, gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt3.patch, gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt4.patch: New files. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/admin.scm (wpa-supplicant-minimal)[source]: Add patches.
Diffstat (limited to 'gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt3.patch')
-rw-r--r--gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt3.patch62
1 files changed, 62 insertions, 0 deletions
diff --git a/gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt3.patch b/gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt3.patch
new file mode 100644
index 0000000000..2dd38fee31
--- /dev/null
+++ b/gnu/packages/patches/wpa-supplicant-CVE-2016-4477-pt3.patch
@@ -0,0 +1,62 @@
+From b166cd84a77a6717be9600bf95378a0055d6f5a5 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni@qca.qualcomm.com>
+Date: Tue, 5 Apr 2016 23:33:10 +0300
+Subject: [PATCH 4/5] Reject SET_CRED commands with newline characters in the
+ string values
+
+Most of the cred block parameters are written as strings without
+filtering and if there is an embedded newline character in the value,
+unexpected configuration file data might be written.
+
+This fixes an issue where wpa_supplicant could have updated the
+configuration file cred parameter with arbitrary data from the control
+interface or D-Bus interface. While those interfaces are supposed to be
+accessible only for trusted users/applications, it may be possible that
+an untrusted user has access to a management software component that
+does not validate the credential value before passing it to
+wpa_supplicant.
+
+This could allow such an untrusted user to inject almost arbitrary data
+into the configuration file. Such configuration file could result in
+wpa_supplicant trying to load a library (e.g., opensc_engine_path,
+pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user
+controlled location when starting again. This would allow code from that
+library to be executed under the wpa_supplicant process privileges.
+
+Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
+---
+ wpa_supplicant/config.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/wpa_supplicant/config.c b/wpa_supplicant/config.c
+index eb97cd5..69152ef 100644
+--- a/wpa_supplicant/config.c
++++ b/wpa_supplicant/config.c
+@@ -2896,6 +2896,8 @@ int wpa_config_set_cred(struct wpa_cred *cred, const char *var,
+
+ if (os_strcmp(var, "password") == 0 &&
+ os_strncmp(value, "ext:", 4) == 0) {
++ if (has_newline(value))
++ return -1;
+ str_clear_free(cred->password);
+ cred->password = os_strdup(value);
+ cred->ext_password = 1;
+@@ -2946,9 +2948,14 @@ int wpa_config_set_cred(struct wpa_cred *cred, const char *var,
+ }
+
+ val = wpa_config_parse_string(value, &len);
+- if (val == NULL) {
++ if (val == NULL ||
++ (os_strcmp(var, "excluded_ssid") != 0 &&
++ os_strcmp(var, "roaming_consortium") != 0 &&
++ os_strcmp(var, "required_roaming_consortium") != 0 &&
++ has_newline(val))) {
+ wpa_printf(MSG_ERROR, "Line %d: invalid field '%s' string "
+ "value '%s'.", line, var, value);
++ os_free(val);
+ return -1;
+ }
+
+--
+1.9.1
+