diff options
Diffstat (limited to 'meta/recipes-connectivity/wpa-supplicant/wpa-supplicant')
3 files changed, 47 insertions, 80 deletions
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch new file mode 100644 index 0000000000..e108a931c0 --- /dev/null +++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch @@ -0,0 +1,47 @@ +From 9ed4eee345f85e3025c33c6e20aa25696e341ccd Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <jouni@qca.qualcomm.com> +Date: Tue, 7 Apr 2015 11:32:11 +0300 +Subject: [PATCH] P2P: Validate SSID element length before copying it + (CVE-2015-1863) + +This fixes a possible memcpy overflow for P2P dev->oper_ssid in +p2p_add_device(). The length provided by the peer device (0..255 bytes) +was used without proper bounds checking and that could have resulted in +arbitrary data of up to 223 bytes being written beyond the end of the +dev->oper_ssid[] array (of which about 150 bytes would be beyond the +heap allocation) when processing a corrupted management frame for P2P +peer discovery purposes. + +This could result in corrupted state in heap, unexpected program +behavior due to corrupted P2P peer device information, denial of service +due to process crash, exposure of memory contents during GO Negotiation, +and potentially arbitrary code execution. + +Thanks to Google security team for reporting this issue and smart +hardware research group of Alibaba security team for discovering it. + +Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> + +Upstream-Status: Backport + +Signed-off-by: Yue Tao <yue.tao@windriver.com> + +--- + src/p2p/p2p.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c +index f584fae..a45fe73 100644 +--- a/src/p2p/p2p.c ++++ b/src/p2p/p2p.c +@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, const u8 *addr, int freq, + if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0) + os_memcpy(dev->interface_addr, addr, ETH_ALEN); + if (msg.ssid && ++ msg.ssid[1] <= sizeof(dev->oper_ssid) && + (msg.ssid[1] != P2P_WILDCARD_SSID_LEN || + os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) + != 0)) { +-- +1.7.9.5 + diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch deleted file mode 100644 index 49a988b676..0000000000 --- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-linux_wext-Fix-types-for-musl.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 159db445dc4cb0af5f6ad85f3a146ad137db5057 Mon Sep 17 00:00:00 2001 -From: Khem Raj <raj.khem@gmail.com> -Date: Fri, 3 Apr 2015 20:38:21 -0700 -Subject: [PATCH] linux_wext: Fix types for musl - -| ../src/drivers/linux_wext.h:24:9: error: unknown type name '__uint32_t' -| typedef __uint32_t __u32; - -Signed-off-by: Khem Raj <raj.khem@gmail.com> -Upstream-Status: Pending ---- - src/drivers/linux_wext.h | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/src/drivers/linux_wext.h b/src/drivers/linux_wext.h -index 55cf955..e66df91 100644 ---- a/src/drivers/linux_wext.h -+++ b/src/drivers/linux_wext.h -@@ -21,11 +21,11 @@ - - #include <sys/types.h> - #include <net/if.h> --typedef __uint32_t __u32; --typedef __int32_t __s32; --typedef __uint16_t __u16; --typedef __int16_t __s16; --typedef __uint8_t __u8; -+typedef u_int32_t __u32; -+typedef int32_t __s32; -+typedef u_int16_t __u16; -+typedef int16_t __s16; -+typedef u_int8_t __u8; - #ifndef __user - #define __user - #endif /* __user */ --- -2.1.4 - diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch deleted file mode 100644 index e899c1655d..0000000000 --- a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/fix-libnl3-host-contamination.patch +++ /dev/null @@ -1,42 +0,0 @@ -Upstream-Status: Pending - -From 37d6b3dd5a737cd67468e4a58b372bddd924a7be Mon Sep 17 00:00:00 2001 -From: Andreas Oberritter <obi@opendreambox.org> -Date: Fri, 8 Mar 2013 22:55:19 +0100 -Subject: [PATCH] Revert "build: Use updated libnl3 header paths" - -This reverts commit e7ecddf33a446072effbc85a27a078a8e582c89e. ---- - src/drivers/drivers.mak | 2 +- - src/drivers/drivers.mk | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/drivers/drivers.mak b/src/drivers/drivers.mak -index 68ff910..1f38f57 100644 ---- a/src/drivers/drivers.mak -+++ b/src/drivers/drivers.mak -@@ -35,7 +35,7 @@ NEED_RFKILL=y - ifdef CONFIG_LIBNL32 - DRV_LIBS += -lnl-3 - DRV_LIBS += -lnl-genl-3 -- DRV_CFLAGS += -DCONFIG_LIBNL20 -I/usr/include/libnl3 -+ DRV_CFLAGS += -DCONFIG_LIBNL20 - ifdef CONFIG_LIBNL3_ROUTE - DRV_LIBS += -lnl-route-3 - DRV_CFLAGS += -DCONFIG_LIBNL3_ROUTE -diff --git a/src/drivers/drivers.mk b/src/drivers/drivers.mk -index db8561a..c93e88d 100644 ---- a/src/drivers/drivers.mk -+++ b/src/drivers/drivers.mk -@@ -30,7 +30,7 @@ NEED_RFKILL=y - ifdef CONFIG_LIBNL32 - DRV_LIBS += -lnl-3 - DRV_LIBS += -lnl-genl-3 -- DRV_CFLAGS += -DCONFIG_LIBNL20 -I/usr/include/libnl3 -+ DRV_CFLAGS += -DCONFIG_LIBNL20 - ifdef CONFIG_LIBNL3_ROUTE - DRV_LIBS += -lnl-route-3 - DRV_CFLAGS += -DCONFIG_LIBNL3_ROUTE --- -1.7.10.4 - |