Module Name: src
Committed By: maxv
Date: Sun Dec 10 08:56:24 UTC 2017
Modified Files:
src/sys/net80211: ieee80211_crypto.c ieee80211_crypto.h
ieee80211_input.c
Log Message:
Fix use-after-free: ieee80211_crypto_decap does a pullup on the mbuf but
the updated pointer is not passed back. Looks like it is triggerable
remotely.
To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.18 src/sys/net80211/ieee80211_crypto.c
cvs rdiff -u -r1.11 -r1.12 src/sys/net80211/ieee80211_crypto.h
cvs rdiff -u -r1.90 -r1.91 src/sys/net80211/ieee80211_input.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/net80211/ieee80211_crypto.c
diff -u src/sys/net80211/ieee80211_crypto.c:1.17 src/sys/net80211/ieee80211_crypto.c:1.18
--- src/sys/net80211/ieee80211_crypto.c:1.17 Mon Aug 24 22:21:26 2015
+++ src/sys/net80211/ieee80211_crypto.c Sun Dec 10 08:56:23 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ieee80211_crypto.c,v 1.17 2015/08/24 22:21:26 pooka Exp $ */
+/* $NetBSD: ieee80211_crypto.c,v 1.18 2017/12/10 08:56:23 maxv Exp $ */
/*-
* Copyright (c) 2001 Atsushi Onoe
* Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
@@ -36,7 +36,7 @@
__FBSDID("$FreeBSD: src/sys/net80211/ieee80211_crypto.c,v 1.12 2005/08/08 18:46:35 sam Exp $");
#endif
#ifdef __NetBSD__
-__KERNEL_RCSID(0, "$NetBSD: ieee80211_crypto.c,v 1.17 2015/08/24 22:21:26 pooka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ieee80211_crypto.c,v 1.18 2017/12/10 08:56:23 maxv Exp $");
#endif
#ifdef _KERNEL_OPT
@@ -565,7 +565,7 @@ ieee80211_crypto_encap(struct ieee80211c
*/
struct ieee80211_key *
ieee80211_crypto_decap(struct ieee80211com *ic,
- struct ieee80211_node *ni, struct mbuf *m, int hdrlen)
+ struct ieee80211_node *ni, struct mbuf **mp, int hdrlen)
{
#define IEEE80211_WEP_HDRLEN (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN)
#define IEEE80211_WEP_MINLEN \
@@ -574,6 +574,7 @@ ieee80211_crypto_decap(struct ieee80211c
struct ieee80211_key *k;
struct ieee80211_frame *wh;
const struct ieee80211_cipher *cip;
+ struct mbuf *m = *mp;
u_int8_t keyid;
/* NB: this minimum size data frame could be bigger */
@@ -605,6 +606,7 @@ ieee80211_crypto_decap(struct ieee80211c
cip = k->wk_cipher;
if (m->m_len < hdrlen + cip->ic_header &&
(m = m_pullup(m, hdrlen + cip->ic_header)) == NULL) {
+ *mp = NULL;
IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,
"[%s] unable to pullup %s header\n",
ether_sprintf(wh->i_addr2), cip->ic_name);
Index: src/sys/net80211/ieee80211_crypto.h
diff -u src/sys/net80211/ieee80211_crypto.h:1.11 src/sys/net80211/ieee80211_crypto.h:1.12
--- src/sys/net80211/ieee80211_crypto.h:1.11 Sat Jan 3 03:43:23 2009
+++ src/sys/net80211/ieee80211_crypto.h Sun Dec 10 08:56:23 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ieee80211_crypto.h,v 1.11 2009/01/03 03:43:23 yamt Exp $ */
+/* $NetBSD: ieee80211_crypto.h,v 1.12 2017/12/10 08:56:23 maxv Exp $ */
/*-
* Copyright (c) 2001 Atsushi Onoe
* Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
@@ -181,7 +181,7 @@ int ieee80211_crypto_available(u_int cip
struct ieee80211_key *ieee80211_crypto_encap(struct ieee80211com *,
struct ieee80211_node *, struct mbuf *);
struct ieee80211_key *ieee80211_crypto_decap(struct ieee80211com *,
- struct ieee80211_node *, struct mbuf *, int);
+ struct ieee80211_node *, struct mbuf **, int);
/*
* Check and remove any MIC.
Index: src/sys/net80211/ieee80211_input.c
diff -u src/sys/net80211/ieee80211_input.c:1.90 src/sys/net80211/ieee80211_input.c:1.91
--- src/sys/net80211/ieee80211_input.c:1.90 Sun Dec 10 08:48:15 2017
+++ src/sys/net80211/ieee80211_input.c Sun Dec 10 08:56:23 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ieee80211_input.c,v 1.90 2017/12/10 08:48:15 maxv Exp $ */
+/* $NetBSD: ieee80211_input.c,v 1.91 2017/12/10 08:56:23 maxv Exp $ */
/*-
* Copyright (c) 2001 Atsushi Onoe
* Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
@@ -36,7 +36,7 @@
__FBSDID("$FreeBSD: src/sys/net80211/ieee80211_input.c,v 1.81 2005/08/10 16:22:29 sam Exp $");
#endif
#ifdef __NetBSD__
-__KERNEL_RCSID(0, "$NetBSD: ieee80211_input.c,v 1.90 2017/12/10 08:48:15 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ieee80211_input.c,v 1.91 2017/12/10 08:56:23 maxv Exp $");
#endif
#ifdef _KERNEL_OPT
@@ -454,7 +454,7 @@ ieee80211_input(struct ieee80211com *ic,
IEEE80211_NODE_STAT(ni, rx_noprivacy);
goto out;
}
- key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
+ key = ieee80211_crypto_decap(ic, ni, &m, hdrspace);
if (key == NULL) {
/* NB: stats+msgs handled in crypto_decap */
IEEE80211_NODE_STAT(ni, rx_wepfail);
@@ -595,7 +595,7 @@ ieee80211_input(struct ieee80211com *ic,
goto out;
}
hdrspace = ieee80211_hdrspace(ic, wh);
- key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
+ key = ieee80211_crypto_decap(ic, ni, &m, hdrspace);
if (key == NULL) {
/* NB: stats+msgs handled in crypto_decap */
goto out;
