Kernel
/
iwd
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git
3
0
Fork 0
Code Releases Activity

netdev: Fix buffer overflow with 32 character ssids 

ssid is declared as a 32 byte field in handshake_state, hence using it
as a string which is assumed to be nul-terminated will fail for SSIDs
that are 32 bytes long.

Fixes: 1f14782857 ("wiphy: add _generate_address_from_ssid")
Fixes: 5a1b1184fc ("netdev: support per-network MAC addresses")
This commit is contained in:
Denis Kenzior 2023-11-26 22:38:45 -06:00 committed by Marcel Holtmann
parent 290f294c60
commit 8d68b33e76
3 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/netdev.c
View File

@ -3526,7 +3526,8 @@ static int netdev_start_powered_mac_change(struct netdev *netdev)
/* No address set in handshake, use per-network MAC generation */
if (l_memeqzero(netdev->handshake->spa, ETH_ALEN))
wiphy_generate_address_from_ssid(netdev->wiphy,
(const char *)netdev->handshake->ssid,
netdev->handshake->ssid,
netdev->handshake->ssid_len,
new_addr);
else
memcpy(new_addr, netdev->handshake->spa, ETH_ALEN);

5
src/wiphy.c
View File

@ -796,12 +796,13 @@ void wiphy_generate_random_address(struct wiphy *wiphy, uint8_t addr[static 6])
wiphy_address_constrain(wiphy, addr);
}
void wiphy_generate_address_from_ssid(struct wiphy *wiphy, const char *ssid,
void wiphy_generate_address_from_ssid(struct wiphy *wiphy,
const uint8_t *ssid, size_t ssid_len,
uint8_t addr[static 6])
{
struct l_checksum *sha = l_checksum_new(L_CHECKSUM_SHA256);
l_checksum_update(sha, ssid, strlen(ssid));
l_checksum_update(sha, ssid, ssid_len);
l_checksum_update(sha, wiphy->permanent_addr,
sizeof(wiphy->permanent_addr));
l_checksum_get_digest(sha, addr, mac_randomize_bytes);

3
src/wiphy.h
View File

@ -146,7 +146,8 @@ const uint8_t *wiphy_get_ht_capabilities(const struct wiphy *wiphy,
enum band_freq band,
size_t *size);
void wiphy_generate_random_address(struct wiphy *wiphy, uint8_t addr[static 6]);
void wiphy_generate_address_from_ssid(struct wiphy *wiphy, const char *ssid,
void wiphy_generate_address_from_ssid(struct wiphy *wiphy,
const uint8_t *ssid, size_t ssid_len,
uint8_t addr[static 6]);
int wiphy_estimate_data_rate(struct wiphy *wiphy,