From 7436cef0129df3f240dedb9687c8d6ad6ff9cd22 Mon Sep 17 00:00:00 2001 From: Joseph Benden Date: Sun, 13 Jun 2021 13:23:44 -0700 Subject: [PATCH] eapol: Use constant-time comparison This closes the possibility of a timing attack against PMKIDs. --- src/eapol.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/eapol.c b/src/eapol.c index f587e708..1c439943 100644 --- a/src/eapol.c +++ b/src/eapol.c @@ -1142,7 +1142,8 @@ static void eapol_handle_ptk_1_of_4(struct eapol_sm *sm, goto error_unspecified; for (i = 0; i < rsn_info.num_pmkids; i++) - if (!memcmp(rsn_info.pmkids + i * 16, pmkid, 16)) { + if (!l_secure_memcmp(rsn_info.pmkids + i * 16, + pmkid, 16)) { found = true; break; } @@ -1155,7 +1156,7 @@ static void eapol_handle_ptk_1_of_4(struct eapol_sm *sm, if (!handshake_state_get_pmkid(sm->handshake, own_pmkid)) goto error_unspecified; - if (memcmp(pmkid, own_pmkid, 16)) { + if (l_secure_memcmp(pmkid, own_pmkid, 16)) { l_debug("Authenticator sent a PMKID that didn't match"); /*