mbox series

[0/2] RSN: Validate GTK KDE lengths before msg 4/4

Message ID 20260512131558.18020-1-chung-hsien.hsu@infineon.com
Headers show
Series RSN: Validate GTK KDE lengths before msg 4/4 | expand

Message

Chung-Hsien Hsu May 12, 2026, 1:15 p.m. UTC 
Validate GTK KDE lengths in EAPOL-Key message 3/4 before transmitting
message 4/4.

The GTK KDE length is already checked when processing the GTK for
installation. However, that validation is reached only after message 4/4
has been transmitted. This allows a malformed message 3/4 with an
invalid GTK KDE length to be acknowledged even though the supplicant
later rejects the GTK and fails the handshake.

This series splits the early validation into non-MLO and MLO changes.

Chung-Hsien Hsu (2):
  RSN: Reject invalid GTK KDE length in msg 3/4
  RSN: Reject invalid MLO GTK KDE length in msg 3/4

 src/rsn_supp/wpa.c | 45 ++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 42 insertions(+), 3 deletions(-)

Comments

Jouni Malinen May 20, 2026, 9:20 a.m. UTC | #1 
On Tue, May 12, 2026 at 09:15:56PM +0800, Chung-Hsien Hsu wrote:
> Validate GTK KDE lengths in EAPOL-Key message 3/4 before transmitting
> message 4/4.
> 
> The GTK KDE length is already checked when processing the GTK for
> installation. However, that validation is reached only after message 4/4
> has been transmitted. This allows a malformed message 3/4 with an
> invalid GTK KDE length to be acknowledged even though the supplicant
> later rejects the GTK and fails the handshake.
> 
> This series splits the early validation into non-MLO and MLO changes.
> 
> Chung-Hsien Hsu (2):
>   RSN: Reject invalid GTK KDE length in msg 3/4
>   RSN: Reject invalid MLO GTK KDE length in msg 3/4

Thanks, applied with some cleanup.