Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1925152 (CVE-2021-0326) - CVE-2021-0326 wpa_supplicant: P2P group information processing vulnerability
Summary: CVE-2021-0326 wpa_supplicant: P2P group information processing vulnerability
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-0326
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1925153 1928763 1928765 1933597
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-02-04 13:53 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-04-17 21:07 UTC (History)
6 users (show)

Fixed In Version: wpa_supplicant 2.10
Doc Type: If docs needed, set a value
Doc Text:
A buffer overflow flaw was found in the P2P (Wi-Fi Direct) support of wpa_supplicant. This flaw allows an attacker within radio range of the vulnerable system to send a specially crafted management frame that triggers a P2P peer device information to be created or updated, leading to the crashing of the wpa_supplicant process or arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-05-18 14:38:17 UTC
Embargoed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-02-04 13:53:01 UTC
A vulnerability was discovered in how wpa_supplicant processing P2P (Wi-Fi Direct) group information from active group owners. The actual parsing of that information validates field lengths appropriately, but processing of the parsed information misses a length check when storing a copy of the secondary device types. This can result in writing attacker controlled data into the peer entry after the area assigned for the secondary device type. The overflow can result in corrupting pointers for heap allocations. This can result in an attacker within radio range of the device running P2P discovery being able to cause unexpected behavior, including termination of the wpa_supplicant process and potentially arbitrary code execution.

Reference:
https://www.openwall.com/lists/oss-security/2021/02/03/4

Upstream patch:
https://w1.fi/cgit/hostap/commit/?id=947272febe24a8f0ea828b5b2f35f13c3821901e

Comment 1 Guilherme de Almeida Suckevicz 2021-02-04 13:53:21 UTC
Created wpa_supplicant tracking bugs for this issue:

Affects: fedora-all [bug 1925153]

Comment 2 Mauro Matteo Cascella 2021-02-15 11:00:29 UTC
External References:

https://w1.fi/security/2020-2/wpa_supplicant-p2p-group-info-processing-vulnerability.txt

Comment 4 Mauro Matteo Cascella 2021-02-15 15:19:08 UTC
The p2p_copy_client_info() function in p2p/p2p.c did not properly check the number of 'sec_dev_type' entries (num_sec_dev_types) leading to a potential buffer overflow when storing a copy of the secondary device types into WPS secondary device type list (wps_sec_dev_type_list). This is prevented in the fixed version by capping the length at WPS_SEC_DEV_TYPE_MAX_LEN, i.e., the maximum size of the buffer.

Comment 5 Mauro Matteo Cascella 2021-02-15 15:27:05 UTC
Mitigation:

Disable Wi-Fi P2P support (Wi-Fi Direct) if not needed, by using the control interface command "P2P_SET disabled 1" or setting "p2p_disabled=1" in wpa_supplicant configuration file.

Comment 7 Fedora Update System 2021-03-19 17:37:01 UTC
FEDORA-2021-defe51d282 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2021-03-19 19:54:43 UTC
FEDORA-2021-defe51d282 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 errata-xmlrpc 2021-05-18 14:15:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1686 https://access.redhat.com/errata/RHSA-2021:1686

Comment 10 Product Security DevOps Team 2021-05-18 14:38:17 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-0326


Note You need to log in before you can comment on or make changes to this bug.