Hi Attached the debdiff between 2:2.7+git20190128+0c1e29f-4 and 2:2.7+git20190128+0c1e29f-5.
Regards, Salvatore
diff -Nru wpa-2.7+git20190128+0c1e29f/debian/changelog wpa-2.7+git20190128+0c1e29f/debian/changelog --- wpa-2.7+git20190128+0c1e29f/debian/changelog 2019-04-10 19:00:22.000000000 +0200 +++ wpa-2.7+git20190128+0c1e29f/debian/changelog 2019-04-26 14:55:52.000000000 +0200 @@ -1,3 +1,11 @@ +wpa (2:2.7+git20190128+0c1e29f-5) unstable; urgency=high + + * Fix security issue 2019-5: + - EAP-pwd message reassembly issue with unexpected fragment + (Closes: #927463, no CVE assigned). + + -- Andrej Shadura <andre...@debian.org> Fri, 26 Apr 2019 14:55:52 +0200 + wpa (2:2.7+git20190128+0c1e29f-4) unstable; urgency=high * Apply security fixes (Closes: #926801): diff -Nru wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch --- wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch 2019-04-26 14:55:52.000000000 +0200 @@ -0,0 +1,45 @@ +From fe76f487e28bdc61940f304f153a954cf36935ea Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <jo...@codeaurora.org> +Date: Wed, 17 Apr 2019 01:55:32 +0300 +Subject: [PATCH 1/3] EAP-pwd server: Fix reassembly buffer handling + +data->inbuf allocation might fail and if that were to happen, the next +fragment in the exchange could have resulted in NULL pointer +dereference. Unexpected fragment with more bit might also be able to +trigger this. Fix that by explicitly checking for data->inbuf to be +available before using it. + +Signed-off-by: Jouni Malinen <jo...@codeaurora.org> +--- + src/eap_server/eap_server_pwd.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c +index 11bef55..38e2af8 100644 +--- a/src/eap_server/eap_server_pwd.c ++++ b/src/eap_server/eap_server_pwd.c +@@ -912,6 +912,12 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, + * the first and all intermediate fragments have the M bit set + */ + if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { ++ if (!data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: No buffer for reassembly"); ++ eap_pwd_state(data, FAILURE); ++ return; ++ } + if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) { + wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow " + "attack detected! (%d+%d > %d)", +@@ -932,7 +938,7 @@ static void eap_pwd_process(struct eap_sm *sm, void *priv, + * last fragment won't have the M bit set (but we're obviously + * buffering fragments so that's how we know it's the last) + */ +- if (data->in_frag_pos) { ++ if (data->in_frag_pos && data->inbuf) { + pos = wpabuf_head_u8(data->inbuf); + len = data->in_frag_pos; + wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", +-- +2.7.4 + diff -Nru wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch --- wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch 2019-04-26 14:55:52.000000000 +0200 @@ -0,0 +1,45 @@ +From d2d1a324ce937628e4d9d9999fe113819b7d4478 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen <jo...@codeaurora.org> +Date: Wed, 17 Apr 2019 02:21:20 +0300 +Subject: [PATCH 3/3] EAP-pwd peer: Fix reassembly buffer handling + +Unexpected fragment might result in data->inbuf not being allocated +before processing and that could have resulted in NULL pointer +dereference. Fix that by explicitly checking for data->inbuf to be +available before using it. + +Signed-off-by: Jouni Malinen <jo...@codeaurora.org> +--- + src/eap_peer/eap_pwd.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/src/eap_peer/eap_pwd.c b/src/eap_peer/eap_pwd.c +index 46894a5..76fcad4 100644 +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -932,6 +932,13 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, + * buffer and ACK the fragment + */ + if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { ++ if (!data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: No buffer for reassembly"); ++ ret->methodState = METHOD_DONE; ++ ret->decision = DECISION_FAIL; ++ return NULL; ++ } + data->in_frag_pos += len; + if (data->in_frag_pos > wpabuf_size(data->inbuf)) { + wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack " +@@ -958,7 +965,7 @@ eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, + /* + * we're buffering and this is the last fragment + */ +- if (data->in_frag_pos) { ++ if (data->in_frag_pos && data->inbuf) { + wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", + (int) len); + pos = wpabuf_head_u8(data->inbuf); +-- +2.7.4 + diff -Nru wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt --- wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.7+git20190128+0c1e29f/debian/patches/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt 2019-04-26 14:55:52.000000000 +0200 @@ -0,0 +1,41 @@ +EAP-pwd message reassembly issue with unexpected fragment + +Published: April 18, 2019 +Latest version available from: https://w1.fi/security/2019-5/ + +Vulnerability + +EAP-pwd implementation in hostapd (EAP server) and wpa_supplicant (EAP +peer) was discovered not to validate fragmentation reassembly state +properly for a case where an unexpected fragment could be received. This +could result in process termination due to NULL pointer dereference. + +An attacker in radio range of a station device with wpa_supplicant +network profile enabling use of EAP-pwd could cause the wpa_supplicant +process to terminate by constructing unexpected sequence of EAP +messages. An attacker in radio range of an access point that points to +hostapd as an authentication server with EAP-pwd user enabled in runtime +configuration (or in non-WLAN uses of EAP authentication as long as the +attacker can send EAP-pwd messages to the server) could cause the +hostapd process to terminate by constructing unexpected sequence of EAP +messages. + + +Vulnerable versions/configurations + +All hostapd and wpa_supplicant versions with EAP-pwd support +(CONFIG_EAP_PWD=y in the build configuration and EAP-pwd being enabled +in the runtime configuration) are vulnerable against the process +termination (denial of service) attack. + + +Possible mitigation steps + +- Merge the following commits to wpa_supplicant/hostapd and rebuild: + + EAP-pwd peer: Fix reassembly buffer handling + EAP-pwd server: Fix reassembly buffer handling + + These patches are available from https://w1.fi/security/2019-5/ + +- Update to wpa_supplicant/hostapd v2.8 or newer, once available diff -Nru wpa-2.7+git20190128+0c1e29f/debian/patches/series wpa-2.7+git20190128+0c1e29f/debian/patches/series --- wpa-2.7+git20190128+0c1e29f/debian/patches/series 2019-04-10 19:00:22.000000000 +0200 +++ wpa-2.7+git20190128+0c1e29f/debian/patches/series 2019-04-26 14:55:52.000000000 +0200 @@ -22,3 +22,5 @@ 2019-sae-eap/0012-EAP-pwd-server-Detect-reflection-attacks.patch 2019-sae-eap/0013-EAP-pwd-client-Verify-received-scalar-and-element.patch 2019-sae-eap/0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch +2019-5/0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch +2019-5/0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch