Re: wpa_supplicant P2P group information processing vulnerability

[Salvatore Bonaccorso <carnil () debian org>]

Hi,

On Thu, Feb 04, 2021 at 01:09:32AM +0200, Jouni Malinen wrote:
> Published: February 4, 2021
> Latest version available from: https://w1.fi/security/2020-2/
>
>
> Vulnerability
>
> A vulnerability was discovered in how wpa_supplicant processing P2P
> (Wi-Fi Direct) group information from active group owners. The actual
> parsing of that information validates field lengths appropriately, but
> a copy of the secondary device types. This can result in writing
> attacker controlled data into the peer entry after the area assigned for
> the secondary device type. The overflow can result in corrupting
> pointers for heap allocations. This can result in an attacker within
> radio range of the device running P2P discovery being able to cause
> unexpected behavior, including termination of the wpa_supplicant process
> and potentially arbitrary code execution.
>
>
> Vulnerable versions/configurations
>
> wpa_supplicant v1.0-v2.9 with CONFIG_P2P build option enabled
>
> An attacker (or a system controlled by the attacker) needs to be within
> radio range of the vulnerable system to send a suitably constructed
> management frame that triggers a P2P peer device information to be
> created or updated.
>
>
> Acknowledgments
>
> This issue was discovered by fuzz testing of wpa_supplicant by Google's
> OSS-Fuzz.
>
> Possible mitigation steps
>
> - Merge the following commit to wpa_supplicant and rebuild it:
>
>   P2P: Fix copying of secondary device types for P2P group client
>   
>   This patch is available from https://w1.fi/security/2020-2/
>   
> - Update to wpa_supplicant v2.10 or newer, once available
>
> - Disable P2P (control interface command "P2P_SET disabled 1" or
>   "p2p_disabled=1" in (each, if multiple interfaces used) wpa_supplicant
>   configuration file)
>
> - Disable P2P from the build (remove CONFIG_P2P=y)

> From https://source.android.com/security/bulletin/2021-02-01
following/referencing to
https://android.googlesource.com/platform/external/wpa_supplicant_8/+/0b60cb210510c68871c8d735285bc4915de3bd80
and the information on
https://bugzilla.redhat.com/show_bug.cgi?id=1925152 this looks that it
hs CVE-2021-0326 assigned.

Regards,
Salvatore