forked from openembedded/meta-openembedded
-
Notifications
You must be signed in to change notification settings - Fork 20
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Can Wong <[email protected]>
- Loading branch information
Showing
69 changed files
with
1,176 additions
and
293 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
71 changes: 71 additions & 0 deletions
71
meta-networking/recipes-extended/tgt/files/CVE-2024-45751.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| From abd8e0d987ab56013d360077202bf2aca20a42dd Mon Sep 17 00:00:00 2001 | ||
| From: Richard Weinberger <[email protected]> | ||
| Date: Tue, 3 Sep 2024 16:14:58 +0200 | ||
| Subject: [PATCH] chap: Use proper entropy source | ||
|
|
||
| The challenge sent to the initiator is based on a poor | ||
| source of randomness, it uses rand() without seeding it by srand(). | ||
| So the glibc PRNG is always seeded with 1 and as a consequence the | ||
| sequence of challenges is always the same. | ||
|
|
||
| An attacker which is able to monitor network traffic can apply a replay | ||
| attack to bypass the CHAP authentication. All the attacker has to do | ||
| is waiting for the server or the service to restart and replay with a | ||
| previously record CHAP session which fits into the sequence. | ||
|
|
||
| To overcome the issue, use getrandom() to query the kernel random | ||
| number generator. | ||
| Also always send a challenge of length CHAP_CHALLENGE_MAX, there is no | ||
| benefit in sending a variable length challenge. | ||
|
|
||
| Signed-off-by: Richard Weinberger <[email protected]> | ||
|
|
||
| Upstream-Status: Backport [https://github.com/fujita/tgt/commit/abd8e0d987ab56013d360077202bf2aca20a42dd] | ||
| CVE: CVE-2024-45751 | ||
| Signed-off-by: Hitendra Prajapati <[email protected]> | ||
| --- | ||
| usr/iscsi/chap.c | 12 +++++------- | ||
| 1 file changed, 5 insertions(+), 7 deletions(-) | ||
|
|
||
| diff --git a/usr/iscsi/chap.c b/usr/iscsi/chap.c | ||
| index aa0fc67..b89ecab 100644 | ||
| --- a/usr/iscsi/chap.c | ||
| +++ b/usr/iscsi/chap.c | ||
| @@ -28,6 +28,7 @@ | ||
| #include <stdio.h> | ||
| #include <stdlib.h> | ||
| #include <string.h> | ||
| +#include <sys/random.h> | ||
|
|
||
| #include "iscsid.h" | ||
| #include "tgtd.h" | ||
| @@ -359,22 +360,19 @@ static int chap_initiator_auth_create_challenge(struct iscsi_connection *conn) | ||
| sprintf(text, "%u", (unsigned char)conn->auth.chap.id); | ||
| text_key_add(conn, "CHAP_I", text); | ||
|
|
||
| - /* | ||
| - * FIXME: does a random challenge length provide any benefits security- | ||
| - * wise, or should we rather always use the max. allowed length of | ||
| - * 1024 for the (unencoded) challenge? | ||
| - */ | ||
| - conn->auth.chap.challenge_size = (rand() % (CHAP_CHALLENGE_MAX / 2)) + CHAP_CHALLENGE_MAX / 2; | ||
| + conn->auth.chap.challenge_size = CHAP_CHALLENGE_MAX; | ||
|
|
||
| conn->auth.chap.challenge = malloc(conn->auth.chap.challenge_size); | ||
| if (!conn->auth.chap.challenge) | ||
| return CHAP_TARGET_ERROR; | ||
|
|
||
| + if (getrandom(conn->auth.chap.challenge, conn->auth.chap.challenge_size, 0) != conn->auth.chap.challenge_size) | ||
| + return CHAP_TARGET_ERROR; | ||
| + | ||
| p = text; | ||
| strcpy(p, "0x"); | ||
| p += 2; | ||
| for (i = 0; i < conn->auth.chap.challenge_size; i++) { | ||
| - conn->auth.chap.challenge[i] = rand(); | ||
| sprintf(p, "%.2hhx", conn->auth.chap.challenge[i]); | ||
| p += 2; | ||
| } | ||
| -- | ||
| 2.25.1 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
...mic-layers/selinux/recipes-devtool/android-tools/android-tools/android-tools-adbd.service
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
52 changes: 52 additions & 0 deletions
52
...nectivity/hostapd/hostapd/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| From 364c2da8741f0979dae497551e70b94c0e6c8636 Mon Sep 17 00:00:00 2001 | ||
| From: Jouni Malinen <[email protected]> | ||
| Date: Sun, 7 Jul 2024 11:46:49 +0300 | ||
| Subject: [PATCH 1/3] SAE: Check for invalid Rejected Groups element length | ||
| explicitly | ||
|
|
||
| Instead of practically ignoring an odd octet at the end of the element, | ||
| check for such invalid case explicitly. This is needed to avoid a | ||
| potential group downgrade attack. | ||
|
|
||
| Signed-off-by: Jouni Malinen <[email protected]> | ||
|
|
||
| CVE: CVE-2024-3596 | ||
| Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=364c2da8741f0979dae497551e70b94c0e6c8636] | ||
| Signed-off-by: Peter Marko <[email protected]> | ||
| --- | ||
| src/ap/ieee802_11.c | 12 ++++++++++-- | ||
| 1 file changed, 10 insertions(+), 2 deletions(-) | ||
|
|
||
| diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c | ||
| index db4104928..1a62e30cc 100644 | ||
| --- a/src/ap/ieee802_11.c | ||
| +++ b/src/ap/ieee802_11.c | ||
| @@ -1258,7 +1258,7 @@ static int check_sae_rejected_groups(struct hostapd_data *hapd, | ||
| struct sae_data *sae) | ||
| { | ||
| const struct wpabuf *groups; | ||
| - size_t i, count; | ||
| + size_t i, count, len; | ||
| const u8 *pos; | ||
|
|
||
| if (!sae->tmp) | ||
| @@ -1268,7 +1268,15 @@ static int check_sae_rejected_groups(struct hostapd_data *hapd, | ||
| return 0; | ||
|
|
||
| pos = wpabuf_head(groups); | ||
| - count = wpabuf_len(groups) / 2; | ||
| + len = wpabuf_len(groups); | ||
| + if (len & 1) { | ||
| + wpa_printf(MSG_DEBUG, | ||
| + "SAE: Invalid length of the Rejected Groups element payload: %zu", | ||
| + len); | ||
| + return 1; | ||
| + } | ||
| + | ||
| + count = len / 2; | ||
| for (i = 0; i < count; i++) { | ||
| int enabled; | ||
| u16 group; | ||
| -- | ||
| 2.30.2 | ||
|
|
38 changes: 38 additions & 0 deletions
38
...nectivity/hostapd/hostapd/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| From 9716bf1160beb677e965d9e6475d6c9e162e8374 Mon Sep 17 00:00:00 2001 | ||
| From: Jouni Malinen <[email protected]> | ||
| Date: Tue, 9 Jul 2024 23:34:34 +0300 | ||
| Subject: [PATCH 3/3] SAE: Reject invalid Rejected Groups element in the parser | ||
|
|
||
| There is no need to depend on all uses (i.e., both hostapd and | ||
| wpa_supplicant) to verify that the length of the Rejected Groups field | ||
| in the Rejected Groups element is valid (i.e., a multiple of two octets) | ||
| since the common parser can reject the message when detecting this. | ||
|
|
||
| Signed-off-by: Jouni Malinen <[email protected]> | ||
|
|
||
| Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=9716bf1160beb677e965d9e6475d6c9e162e8374] | ||
| Signed-off-by: Peter Marko <[email protected]> | ||
| --- | ||
| src/common/sae.c | 6 ++++++ | ||
| 1 file changed, 6 insertions(+) | ||
|
|
||
| diff --git a/src/common/sae.c b/src/common/sae.c | ||
| index c0f154e91..620bdf753 100644 | ||
| --- a/src/common/sae.c | ||
| +++ b/src/common/sae.c | ||
| @@ -2076,6 +2076,12 @@ static int sae_parse_rejected_groups(struct sae_data *sae, | ||
| return WLAN_STATUS_UNSPECIFIED_FAILURE; | ||
| epos++; /* skip ext ID */ | ||
| len--; | ||
| + if (len & 1) { | ||
| + wpa_printf(MSG_DEBUG, | ||
| + "SAE: Invalid length of the Rejected Groups element payload: %u", | ||
| + len); | ||
| + return WLAN_STATUS_UNSPECIFIED_FAILURE; | ||
| + } | ||
|
|
||
| wpabuf_free(sae->tmp->peer_rejected_groups); | ||
| sae->tmp->peer_rejected_groups = wpabuf_alloc(len); | ||
| -- | ||
| 2.30.2 | ||
|
|
82 changes: 82 additions & 0 deletions
82
meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_00.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| From 945acf3ef06a6c312927da4fa055693dbac432d1 Mon Sep 17 00:00:00 2001 | ||
| From: Jouni Malinen <[email protected]> | ||
| Date: Sat, 2 Apr 2022 16:28:12 +0300 | ||
| Subject: [PATCH 1/9] ieee802_11_auth: Coding style cleanup - no string | ||
| constant splitting | ||
|
|
||
| Signed-off-by: Jouni Malinen <[email protected]> | ||
|
|
||
| Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=945acf3ef06a6c312927da4fa055693dbac432d1] | ||
| Signed-off-by: Peter Marko <[email protected]> | ||
| --- | ||
| src/ap/ieee802_11_auth.c | 27 +++++++++++++++------------ | ||
| 1 file changed, 15 insertions(+), 12 deletions(-) | ||
|
|
||
| diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c | ||
| index 783ee6dea..47cc625be 100644 | ||
| --- a/src/ap/ieee802_11_auth.c | ||
| +++ b/src/ap/ieee802_11_auth.c | ||
| @@ -267,16 +267,16 @@ int hostapd_allowed_address(struct hostapd_data *hapd, const u8 *addr, | ||
| os_get_reltime(&query->timestamp); | ||
| os_memcpy(query->addr, addr, ETH_ALEN); | ||
| if (hostapd_radius_acl_query(hapd, addr, query)) { | ||
| - wpa_printf(MSG_DEBUG, "Failed to send Access-Request " | ||
| - "for ACL query."); | ||
| + wpa_printf(MSG_DEBUG, | ||
| + "Failed to send Access-Request for ACL query."); | ||
| hostapd_acl_query_free(query); | ||
| return HOSTAPD_ACL_REJECT; | ||
| } | ||
|
|
||
| query->auth_msg = os_memdup(msg, len); | ||
| if (query->auth_msg == NULL) { | ||
| - wpa_printf(MSG_ERROR, "Failed to allocate memory for " | ||
| - "auth frame."); | ||
| + wpa_printf(MSG_ERROR, | ||
| + "Failed to allocate memory for auth frame."); | ||
| hostapd_acl_query_free(query); | ||
| return HOSTAPD_ACL_REJECT; | ||
| } | ||
| @@ -467,19 +467,21 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req, | ||
| if (query == NULL) | ||
| return RADIUS_RX_UNKNOWN; | ||
|
|
||
| - wpa_printf(MSG_DEBUG, "Found matching Access-Request for RADIUS " | ||
| - "message (id=%d)", query->radius_id); | ||
| + wpa_printf(MSG_DEBUG, | ||
| + "Found matching Access-Request for RADIUS message (id=%d)", | ||
| + query->radius_id); | ||
|
|
||
| if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) { | ||
| - wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have " | ||
| - "correct authenticator - dropped\n"); | ||
| + wpa_printf(MSG_INFO, | ||
| + "Incoming RADIUS packet did not have correct authenticator - dropped"); | ||
| return RADIUS_RX_INVALID_AUTHENTICATOR; | ||
| } | ||
|
|
||
| if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT && | ||
| hdr->code != RADIUS_CODE_ACCESS_REJECT) { | ||
| - wpa_printf(MSG_DEBUG, "Unknown RADIUS message code %d to ACL " | ||
| - "query", hdr->code); | ||
| + wpa_printf(MSG_DEBUG, | ||
| + "Unknown RADIUS message code %d to ACL query", | ||
| + hdr->code); | ||
| return RADIUS_RX_UNKNOWN; | ||
| } | ||
|
|
||
| @@ -506,8 +508,9 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req, | ||
| msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL, | ||
| &info->acct_interim_interval) == 0 && | ||
| info->acct_interim_interval < 60) { | ||
| - wpa_printf(MSG_DEBUG, "Ignored too small " | ||
| - "Acct-Interim-Interval %d for STA " MACSTR, | ||
| + wpa_printf(MSG_DEBUG, | ||
| + "Ignored too small Acct-Interim-Interval %d for STA " | ||
| + MACSTR, | ||
| info->acct_interim_interval, | ||
| MAC2STR(query->addr)); | ||
| info->acct_interim_interval = 0; | ||
| -- | ||
| 2.30.2 | ||
|
|
Oops, something went wrong.