package/kernel/mac80211/patches/subsys/383-cfg80211-mitigate-A-MSDU-aggregation-attacks.patch

   1 From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
   2 Date: Tue, 11 May 2021 20:02:45 +0200
   3 Subject: [PATCH] cfg80211: mitigate A-MSDU aggregation attacks
   4
   5 Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the
   6 destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP)
   7 header, and if so dropping the complete A-MSDU frame. This mitigates
   8 known attacks, although new (unknown) aggregation-based attacks may
   9 remain possible.
  10
  11 This defense works because in A-MSDU aggregation injection attacks, a
  12 normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
  13 the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
  14 header. In other words, the destination MAC address of the first A-MSDU
  15 subframe contains the start of an RFC1042 header during an aggregation
  16 attack. We can detect this and thereby prevent this specific attack.
  17 For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi
  18 Through Frame Aggregation and Fragmentation".
  19
  20 Note that for kernel 4.9 and above this patch depends on "mac80211:
  21 properly handle A-MSDUs that start with a rfc1042 header". Otherwise
  22 this patch has no impact and attacks will remain possible.
  23
  24 Cc: stable@vger.kernel.org
  25 Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
  26 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  27 ---
  28
  29 --- a/net/wireless/util.c
  30 +++ b/net/wireless/util.c
  31 @@ -775,6 +775,9 @@ void ieee80211_amsdu_to_8023s(struct sk_
  32                 remaining = skb->len - offset;
  33                 if (subframe_len > remaining)
  34                         goto purge;
  35 +               /* mitigate A-MSDU aggregation injection attacks */
  36 +               if (ether_addr_equal(eth.h_dest, rfc1042_header))
  37 +                       goto purge;
  38
  39                 offset += sizeof(struct ethhdr);
  40                 last = remaining <= subframe_len + padding;