hostapd: fix CVE-2019-9497, CVE-2019-9498, CVE-2019-9499

[openwrt/openwrt.git] / package / network / services / hostapd / patches / 064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch

diff --git a/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch b/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch
new file mode 100644 (file)
index 0000000..8ecb5fd
--- /dev/null
+++ b/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch
@@ -0,0 +1,53 @@
+From 70ff850e89fbc8bc7da515321b4d15b5eef70581 Mon Sep 17 00:00:00 2001
+From: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
+Date: Sun, 31 Mar 2019 17:13:06 +0200
+Subject: [PATCH 11/14] EAP-pwd server: Verify received scalar and element
+
+When processing an EAP-pwd Commit frame, the peer's scalar and element
+(elliptic curve point) were not validated. This allowed an adversary to
+bypass authentication, and impersonate any user if the crypto
+implementation did not verify the validity of the EC point.
+
+Fix this vulnerability by assuring the received scalar lies within the
+valid range, and by checking that the received element is not the point
+at infinity and lies on the elliptic curve being used. (CVE-2019-9498)
+
+The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower
+is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL
+(and also BoringSSL) implicitly validate the elliptic curve point in
+EC_POINT_set_affine_coordinates_GFp(), preventing the attack.
+
+Signed-off-by: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
+---
+ src/eap_server/eap_server_pwd.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/src/eap_server/eap_server_pwd.c
++++ b/src/eap_server/eap_server_pwd.c
+@@ -718,6 +718,26 @@ eap_pwd_process_commit_resp(struct eap_s
+               goto fin;
+       }
+ 
++      /* verify received scalar */
++      if (crypto_bignum_is_zero(data->peer_scalar) ||
++          crypto_bignum_is_one(data->peer_scalar) ||
++          crypto_bignum_cmp(data->peer_scalar,
++                            crypto_ec_get_order(data->grp->group)) >= 0) {
++              wpa_printf(MSG_INFO,
++                         "EAP-PWD (server): received scalar is invalid");
++              goto fin;
++      }
++
++      /* verify received element */
++      if (!crypto_ec_point_is_on_curve(data->grp->group,
++                                       data->peer_element) ||
++          crypto_ec_point_is_at_infinity(data->grp->group,
++                                         data->peer_element)) {
++              wpa_printf(MSG_INFO,
++                         "EAP-PWD (server): received element is invalid");
++              goto fin;
++      }
++
+       /* check to ensure peer's element is not in a small sub-group */
+       if (!crypto_bignum_is_one(cofactor)) {
+               if (crypto_ec_point_mul(data->grp->group, data->peer_element,