From patchwork Fri Oct 14 16:47:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Berg X-Patchwork-Id: 13007211 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 465B6C4321E for ; Fri, 14 Oct 2022 16:47:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230187AbiJNQrw (ORCPT ); Fri, 14 Oct 2022 12:47:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37002 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229648AbiJNQru (ORCPT ); Fri, 14 Oct 2022 12:47:50 -0400 Received: from sipsolutions.net (s3.sipsolutions.net [IPv6:2a01:4f8:191:4433::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 98C34164BC5; Fri, 14 Oct 2022 09:47:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-To: Resent-Cc:Resent-Message-ID; bh=xh1eF1VNKdVSLkowbBpClGexyVZzHDZ1YnAtiCz/WBI=; t=1665766068; x=1666975668; b=tH2qQJnv90MHktePXW5p2GrEFaUZvbGhB7EF7M5CUCWEKc6 /AyT7c9l/ypDZcDZcAuyhwXJSAmufsU9r0oF7J6U9nbyHklqLvOwo/kKwNwTFIgU0hY6eYqo9QvP/ 0lXUcHq+Q7cnOIGnmki9P+xlysjumantcLnCXU1W5iDqKLAh/Bp8nvdf+rzYUo3j6e3CC1bQKrwCt zp2qk4PdaAZeubIpmbveOPaPvkiY2xXI1h51rzd1cTku17A635l9MMw4sptGxjggGzA7mH5ynBGdp N4c/fWTWJ8uGpWkS3l0QhogwDuMxdHxG1hMHZt6vg5rz76EwiC44yj/ymC9xyJXg==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1ojNqZ-006gzN-02; Fri, 14 Oct 2022 18:47:43 +0200 From: Johannes Berg To: linux-wireless@vger.kernel.org, stable@vger.kernel.org Cc: Felix Fietkau , Thadeu Lima de Souza Cascardo , Marcus Meissner , Jiri Kosina , Steve deRosier , Johannes Berg Subject: [RFC v5.4 1/3] mac80211: mlme: find auth challenge directly Date: Fri, 14 Oct 2022 18:47:03 +0200 Message-Id: <20221014164705.31486-2-johannes@sipsolutions.net> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20221014164705.31486-1-johannes@sipsolutions.net> References: <20221014164705.31486-1-johannes@sipsolutions.net> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg There's no need to parse all elements etc. just to find the authentication challenge - use cfg80211_find_elem() instead. This also allows us to remove WLAN_EID_CHALLENGE handling from the element parsing entirely. Link: https://lore.kernel.org/r/20210920154009.45f9b3a15722.Ice3159ffad03a007d6154cbf1fb3a8c48489e86f@changeid Signed-off-by: Johannes Berg --- net/mac80211/ieee80211_i.h | 2 -- net/mac80211/mlme.c | 11 ++++++----- net/mac80211/util.c | 4 ---- 3 files changed, 6 insertions(+), 11 deletions(-) diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index 7747a6f46d29..3d5da7a97be4 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1460,7 +1460,6 @@ struct ieee802_11_elems { const u8 *supp_rates; const u8 *ds_params; const struct ieee80211_tim_ie *tim; - const u8 *challenge; const u8 *rsn; const u8 *erp_info; const u8 *ext_supp_rates; @@ -1507,7 +1506,6 @@ struct ieee802_11_elems { u8 ssid_len; u8 supp_rates_len; u8 tim_len; - u8 challenge_len; u8 rsn_len; u8 ext_supp_rates_len; u8 wmm_info_len; diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 5415e566e09d..aaec8a78b159 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -2829,14 +2829,14 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata, { struct ieee80211_local *local = sdata->local; struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data; + const struct element *challenge; u8 *pos; - struct ieee802_11_elems elems; u32 tx_flags = 0; pos = mgmt->u.auth.variable; - ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems, - mgmt->bssid, auth_data->bss->bssid); - if (!elems.challenge) + challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos, + len - (pos - (u8 *)mgmt)); + if (!challenge) return; auth_data->expected_transaction = 4; drv_mgd_prepare_tx(sdata->local, sdata, 0); @@ -2844,7 +2844,8 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata, tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS | IEEE80211_TX_INTFL_MLME_CONN_TX; ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0, - elems.challenge - 2, elems.challenge_len + 2, + (void *)challenge, + challenge->datalen + sizeof(*challenge), auth_data->bss->bssid, auth_data->bss->bssid, auth_data->key, auth_data->key_len, auth_data->key_idx, tx_flags); diff --git a/net/mac80211/util.c b/net/mac80211/util.c index a529861256e6..1ba37f67a2a0 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -1006,10 +1006,6 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, } else elem_parse_failed = true; break; - case WLAN_EID_CHALLENGE: - elems->challenge = pos; - elems->challenge_len = elen; - break; case WLAN_EID_VENDOR_SPECIFIC: if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 && pos[2] == 0xf2) { From patchwork Fri Oct 14 16:47:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Berg X-Patchwork-Id: 13007212 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DDD4C43219 for ; Fri, 14 Oct 2022 16:48:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229471AbiJNQsK (ORCPT ); Fri, 14 Oct 2022 12:48:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37926 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231169AbiJNQsJ (ORCPT ); Fri, 14 Oct 2022 12:48:09 -0400 Received: from sipsolutions.net (s3.sipsolutions.net [IPv6:2a01:4f8:191:4433::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C2131C7D63; Fri, 14 Oct 2022 09:47:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-To: Resent-Cc:Resent-Message-ID; bh=P+p9ZLEDYTWGgS51mcVAADhDwgpSOEE4/vNxHMyV37A=; t=1665766080; x=1666975680; b=rVCULPUeKHPf2AIjpb4XD8z0fJdrpImH3E3Bc2ML33yBOwD A9B58BsxNV/+oNGxQldvtHvPxPXzAJjrXbtvmlweAjF2dfhkQ0KNdbA5Sv8a+ZCN26Mneaf0QlAzF C3O6SmURg3hN1s5ju5Uq9FUdHasNync0UlEEMHkrh4QR0zFIr9wsLTtG+RsebwUpvcBNqJsvwInvR +eAWtduuf0AcOp7I0DtCF1J4e9nRO/rvgsncWqq4eWGGhvUQDoeu0Gh6uYvkKY3NWIQB1Ub1Al+SB lwH5sVEH0fCZrtaqrl/ylDmiX1tdvQ4LQw1cce0hvUmhlbuHdyRf9jOAoOCW1GmQ==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1ojNqj-006gzN-0I; Fri, 14 Oct 2022 18:47:54 +0200 From: Johannes Berg To: linux-wireless@vger.kernel.org, stable@vger.kernel.org Cc: Felix Fietkau , Thadeu Lima de Souza Cascardo , Marcus Meissner , Jiri Kosina , Steve deRosier , Johannes Berg Subject: [RFC v5.4 2/3] wifi: mac80211: don't parse mbssid in assoc response Date: Fri, 14 Oct 2022 18:47:04 +0200 Message-Id: <20221014184650.f3deb2e15fcb.I6c0186979a2872e7f7da75f9f8f93b07046afcf2@changeid> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20221014164705.31486-1-johannes@sipsolutions.net> References: <20221014164705.31486-1-johannes@sipsolutions.net> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg This is simply not valid and simplifies the next commit. I'll make a separate patch for this in the current main tree as well. Signed-off-by: Johannes Berg --- net/mac80211/mlme.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index aaec8a78b159..7d116aa4ea1f 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -3224,7 +3224,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata, pos = mgmt->u.assoc_resp.variable; ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems, - mgmt->bssid, assoc_data->bss->bssid); + mgmt->bssid, NULL); if (!elems.supp_rates) { sdata_info(sdata, "no SuppRates element in AssocResp\n"); @@ -3576,7 +3576,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata, pos = mgmt->u.assoc_resp.variable; ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems, - mgmt->bssid, assoc_data->bss->bssid); + mgmt->bssid, NULL); if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY && elems.timeout_int && From patchwork Fri Oct 14 16:47:05 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johannes Berg X-Patchwork-Id: 13007213 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CAA3C43219 for ; Fri, 14 Oct 2022 16:48:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230071AbiJNQsV (ORCPT ); Fri, 14 Oct 2022 12:48:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38072 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229994AbiJNQsL (ORCPT ); Fri, 14 Oct 2022 12:48:11 -0400 Received: from sipsolutions.net (s3.sipsolutions.net [IPv6:2a01:4f8:191:4433::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1AC411C97D6; Fri, 14 Oct 2022 09:48:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sipsolutions.net; s=mail; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Content-Type:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-To: Resent-Cc:Resent-Message-ID; bh=GECKQhOYk4SRCHi7X/tcBe1wmEDBMxeEoS0zQhgrTvk=; t=1665766088; x=1666975688; b=hrBD6fgmVf6NZfX1gngYAVN1DJf2kWQXR/mB28ecHn86vsF QbtzeAwFbMEofH0i/vsRbTiF/0x5nLNOvQaTHAXXLzSQGTqNT0AIn4Ys1n0yFgJ4I24oqEImc8x9n Kb2O1OXjMHUwMPGLx4B0qDX+HsRphpD4vAn7pHGr0vIhcxPkP+Hm2JGQVuID+vIp7OTM+ojkN2NAV MXUaj9i5j2qnxXzvpI2jVxG1Rrbton37c9l7YTm+mVKmwAD4KxBHlSX+8H8AVNVCeXgWQcyT9oatK CJL1VedbHvzX7fTKZZJW6MDc9n2T1IcyxTner6EOLr2cX+hIN6BepCHrP8TkbGSg==; Received: by sipsolutions.net with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1ojNqr-006gzN-0U; Fri, 14 Oct 2022 18:48:03 +0200 From: Johannes Berg To: linux-wireless@vger.kernel.org, stable@vger.kernel.org Cc: Felix Fietkau , Thadeu Lima de Souza Cascardo , Marcus Meissner , Jiri Kosina , Steve deRosier , Johannes Berg , Ilan Peer , Kees Cook Subject: [RFC v5.4 3/3] wifi: mac80211: fix MBSSID parsing use-after-free Date: Fri, 14 Oct 2022 18:47:05 +0200 Message-Id: <20221014184650.0065abf86cc0.I4691a91b83e1325524f786a638e853ccb49c2443@changeid> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20221014164705.31486-1-johannes@sipsolutions.net> References: <20221014164705.31486-1-johannes@sipsolutions.net> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg Commit ff05d4b45dd89b922578dac497dcabf57cf771c6 upstream. This is a different version of the commit, changed to store the non-transmitted profile in the elems, and freeing it in the few places where it's relevant, since that is only the case when the last argument for parsing (the non-tx BSSID) is non-NULL. When we parse a multi-BSSID element, we might point some element pointers into the allocated nontransmitted_profile. However, we free this before returning, causing UAF when the relevant pointers in the parsed elements are accessed. Fix this by not allocating the scratch buffer separately but as part of the returned structure instead, that way, there are no lifetime issues with it. The scratch buffer introduction as part of the returned data here is taken from MLO feature work done by Ilan. This fixes CVE-2022-42719. Fixes: 5023b14cf4df ("mac80211: support profile split between elements") Co-developed-by: Ilan Peer Signed-off-by: Ilan Peer Reviewed-by: Kees Cook Signed-off-by: Johannes Berg --- net/mac80211/ieee80211_i.h | 2 ++ net/mac80211/mlme.c | 6 +++++- net/mac80211/scan.c | 2 ++ net/mac80211/util.c | 7 ++++++- 4 files changed, 15 insertions(+), 2 deletions(-) diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index 3d5da7a97be4..f30a205323de 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1519,6 +1519,8 @@ struct ieee802_11_elems { u8 country_elem_len; u8 bssid_index_len; + void *nontx_profile; + /* whether a parse error occurred while retrieving these elements */ bool parse_error; }; diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 7d116aa4ea1f..b48a09043663 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -3299,6 +3299,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata, sdata_info(sdata, "AP bug: VHT operation missing from AssocResp\n"); } + kfree(bss_elems.nontx_profile); } /* @@ -3883,6 +3884,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, ifmgd->assoc_data->timeout = jiffies; ifmgd->assoc_data->timeout_started = true; run_again(sdata, ifmgd->assoc_data->timeout); + kfree(elems.nontx_profile); return; } @@ -4050,7 +4052,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, ieee80211_report_disconnect(sdata, deauth_buf, sizeof(deauth_buf), true, WLAN_REASON_DEAUTH_LEAVING); - return; + goto free; } if (sta && elems.opmode_notif) @@ -4065,6 +4067,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata, elems.cisco_dtpc_elem); ieee80211_bss_info_change_notify(sdata, changed); +free: + kfree(elems.nontx_profile); } void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c index c353162e81ae..ee65f1f50a0a 100644 --- a/net/mac80211/scan.c +++ b/net/mac80211/scan.c @@ -216,6 +216,8 @@ ieee80211_bss_info_update(struct ieee80211_local *local, rx_status, beacon); } + kfree(elems.nontx_profile); + return bss; } diff --git a/net/mac80211/util.c b/net/mac80211/util.c index 1ba37f67a2a0..6223af1c3457 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -1363,6 +1363,11 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, nontransmitted_profile, nontransmitted_profile_len); + if (!nontransmitted_profile_len) { + nontransmitted_profile_len = 0; + kfree(nontransmitted_profile); + nontransmitted_profile = NULL; + } } crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter, @@ -1392,7 +1397,7 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, offsetofend(struct ieee80211_bssid_index, dtim_count)) elems->dtim_count = elems->bssid_index->dtim_count; - kfree(nontransmitted_profile); + elems->nontx_profile = nontransmitted_profile; return crc; }