Notification time stamped 2021-03-01 09:50:43 UTC
From d60627e92920793877b58b290fcbd4b4e8e95f04 Mon Sep 17 00:00:00 2001
From: Davide Caratti <dcaratti(a)redhat.com>
Date: Mar 01 2021 09:40:38 +0000
Subject: P2P: Fix a corner case in peer addition based on PD Request
CVE-2021-27803
Upstream advisory:
https://w1.fi/security/2021-1/wpa_supplicant-p2p-provision-discovery-proc...
Signed-off-by: Davide Caratti <dcaratti(a)redhat.com>
---
diff --git a/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
b/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
new file mode 100644
index 0000000..1942bb3
--- /dev/null
+++ b/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
@@ -0,0 +1,50 @@
+From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni(a)codeaurora.org>
+Date: Tue, 8 Dec 2020 23:52:50 +0200
+Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
+
+p2p_add_device() may remove the oldest entry if there is no room in the
+peer table for a new peer. This would result in any pointer to that
+removed entry becoming stale. A corner case with an invalid PD Request
+frame could result in such a case ending up using (read+write) freed
+memory. This could only by triggered when the peer table has reached its
+maximum size and the PD Request frame is received from the P2P Device
+Address of the oldest remaining entry and the frame has incorrect P2P
+Device Address in the payload.
+
+Fix this by fetching the dev pointer again after having called
+p2p_add_device() so that the stale pointer cannot be used.
+
+Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery
Request")
+Signed-off-by: Jouni Malinen <jouni(a)codeaurora.org>
+---
+ src/p2p/p2p_pd.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
+index 3994ec03f86b..05fd593494ef 100644
+--- a/src/p2p/p2p_pd.c
++++ b/src/p2p/p2p_pd.c
+@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,
+ goto out;
+ }
+
++ dev = p2p_get_device(p2p, sa);
+ if (!dev) {
+- dev = p2p_get_device(p2p, sa);
+- if (!dev) {
+- p2p_dbg(p2p,
+- "Provision Discovery device not found "
+- MACSTR, MAC2STR(sa));
+- goto out;
+- }
++ p2p_dbg(p2p,
++ "Provision Discovery device not found "
++ MACSTR, MAC2STR(sa));
++ goto out;
+ }
+ } else if (msg.wfd_subelems) {
+ wpabuf_free(dev->info.wfd_subelems);
+--
+2.25.1
+
diff --git a/wpa_supplicant.spec b/wpa_supplicant.spec
index 6fb8bc5..95aaa37 100644
--- a/wpa_supplicant.spec
+++ b/wpa_supplicant.spec
@@ -9,7 +9,7 @@ Summary: WPA/WPA2/IEEE 802.1X Supplicant
Name: wpa_supplicant
Epoch: 1
Version: 2.9
-Release: 11%{?dist}
+Release: 12%{?dist}
License: BSD
Source0:
http://w1.fi/releases/%{name}-%{version}.tar.gz
Source1: wpa_supplicant.conf
@@ -46,6 +46,9 @@ Patch10: 0001-dbus-Export-OWE-capability-and-OWE-BSS-key_mgmt.patch
#fix for CVE-2021-0326
Patch11: 0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch
+#fix for CVE-2021-27803
+Patch12: 0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
+
URL:
http://w1.fi/wpa_supplicant/
%if %with gui
@@ -205,6 +208,9 @@ chmod -R 0644 wpa_supplicant/examples/*.py
%changelog
+* Mon Mar 1 2021 Davide Caratti <dcaratti(a)redhat.com> - 1:2.9-12
+- Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
+
* Thu Feb 4 2021 Davide Caratti <dcaratti(a)redhat.com> - 1:2.9-11
- Fix copying of secondary device types for P2P group client (CVE-2021-0326)
https://src.fedoraproject.org/rpms/wpa_supplicant/c/d60627e92920793877b58...