Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package wpa_supplicant for openSUSE:Factory checked in at 2026-08-01 18:29:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/wpa_supplicant (Old) and /work/SRC/openSUSE:Factory/.wpa_supplicant.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "wpa_supplicant" Sat Aug 1 18:29:01 2026 rev:103 rq:1368539 version:2.11 Changes: -------- --- /work/SRC/openSUSE:Factory/wpa_supplicant/wpa_supplicant.changes 2026-07-10 17:35:43.057655222 +0200 +++ /work/SRC/openSUSE:Factory/.wpa_supplicant.new.16738/wpa_supplicant.changes 2026-08-01 18:29:51.424848518 +0200 @@ -1,0 +2,6 @@ +Thu Jul 30 09:37:32 UTC 2026 - Clemens Famulla-Conrad <[email protected]> + +- Add mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch + https://w1.fi/security/2026-4/ + +------------------------------------------------------------------- New: ---- mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch ----------(New B)---------- New: - Add mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch https://w1.fi/security/2026-4/ ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ wpa_supplicant.spec ++++++ --- /var/tmp/diff_new_pack.D2J2vv/_old 2026-08-01 18:29:52.244876431 +0200 +++ /var/tmp/diff_new_pack.D2J2vv/_new 2026-08-01 18:29:52.248876566 +0200 @@ -51,6 +51,8 @@ Patch11: Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch # PATCH-FIX-UPSTREAM https://w1.fi/security/2026-3/ Patch12: SAE-Fix-crash-due-to-NULL-pointer-dereference-in-H2E.patch +# PATCH-FIX-UPSTREAM https://w1.fi/security/2026-4/ +Patch13: mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch BuildRequires: pkgconfig BuildRequires: readline-devel BuildRequires: systemd-rpm-macros ++++++ mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch ++++++ >From 0ef47396926cb8ce4827b6a5a593ebfc270b8e06 Mon Sep 17 00:00:00 2001 From: Mingyu Jung <[email protected]> Date: Wed, 29 Jul 2026 22:12:12 +0900 Subject: [PATCH] mesh: Reject AMPE MIC element with length != AES_BLOCK_SIZE Reference: https://w1.fi/security/2026-4/ mesh_rsn_process_ampe() positioned the AMPE decrypt output at elems->mic + elems->mic_len and only required elems->mic_len to be at least AES_BLOCK_SIZE (16). The SIV tag is always exactly one AES block, so a peer that sent a MIC element longer than 16 octets pushed ampe_buf forward by mic_len while aes_siv_decrypt() still wrote crypt_len - AES_BLOCK_SIZE plaintext bytes there (before the tag is verified), ending (mic_len - 16) bytes past the received frame buffer. With a 255-octet MIC element this results in a 239-byte out-of-bounds heap write of attacker controlled content, reachable from a mesh peer that is able to complete SAE authentication successfully (i.e., knows the password). Require the MIC element to be exactly AES_BLOCK_SIZE to avoid this. Signed-off-by: Mingyu Jung <[email protected]> --- wpa_supplicant/mesh_rsn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/wpa_supplicant/mesh_rsn.c +++ b/wpa_supplicant/mesh_rsn.c @@ -679,7 +679,7 @@ int mesh_rsn_process_ampe(struct wpa_sup return -1; } - if (!elems->mic || elems->mic_len < AES_BLOCK_SIZE) { + if (!elems->mic || elems->mic_len != AES_BLOCK_SIZE) { wpa_msg(wpa_s, MSG_DEBUG, "Mesh RSN: missing mic ie"); return -1; }
