From patchwork Tue May 12 13:15:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chung-Hsien Hsu X-Patchwork-Id: 2236874 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=gv9XXuSw; dkim=fail reason="signature verification failed" (2048-bit key; secure) header.d=infradead.org header.i=@infradead.org header.a=rsa-sha256 header.s=desiato.20200630 header.b=AF4sS2t2; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=infineon.com header.i=@infineon.com header.a=rsa-sha256 header.s=IFXMAIL header.b=euJpQILo; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4gFHNF0q9qz1yHx for ; Tue, 12 May 2026 23:23:25 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:CC:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=3px3we9jNiwgR5CKE2jspn2snO/0/hJBBklYTRQDGdg=; b=gv9XXuSw3yWYhn bSVr7T0OPJtQ+4Mv49cYivZWrQaMXSwXacMb7WBQZjVnMGNT6xfwgtKoarzBSOFxGB9etHaOHtKQR 7Kjj3JxhD7LjsKHR3hm708GmEOvp/0z90LDAIeQqk/dNn1H/w0eYe+hiK50xD8m5PYETVJfEGNmWi 8OXHpqYiyIpxvfxMyhDqtXmV8nNOhSqkmmkD3nc2P15XwFJreuaHmN4YJsC9XwoXZbWKXRabRXSd6 vHCzv9VRpB/9eq587h9IvwhC1G8h6+Y1vlj7287NCbdz+4v7vgV/wPf3n74l2rUeZ5F6susR9C2CH PlVOKu2KAgkJnf8jfGiQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wMn3b-0000000GoxI-2QzN; Tue, 12 May 2026 13:21:55 +0000 Received: from desiato.infradead.org ([2001:8b0:10b:1:d65d:64ff:fe57:4e05]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wMn3a-0000000Gowf-196Z for hostap@bombadil.infradead.org; Tue, 12 May 2026 13:21:54 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=Content-Type:Content-Transfer-Encoding :MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From: Sender:Reply-To:Content-ID:Content-Description; bh=FlCtD6wAu1jbHa1S7cYY2zkmybCQ54LwlsEtDPnvtnw=; b=AF4sS2t2JMxJGlMct4jEWqdCO1 sbaGVGyo3509Rk9jpbeIjic7QZGcEkpzQt3tXup9VlIzKgznFcpXA9ydbBNrG5boOFxvK/1Yu+n3K +eNp0wmC4Ri79rnNNCVKidRNNBe+P964kFyPA0vF0hqzkeXuIQQdD5K1PyVjvtTK8i+6SZ1E0EGmC cpef2QUglYCBkDpib9xqIDUnhxbQEBEngPjHBry1PlE0ACpH5AMtEEOfUhnr7ARYjUxcdnwiYJEwr hYGNgukaz8YV5VLYqkEBC4K1HFe9GsICwowEbYWt8JwENbXXuP6xex7sNCbhh5bjfp8X7tLCaQyD/ wUrf9E1w==; Received: from smtp9.infineon.com ([217.10.52.204]) by desiato.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wMn3V-0000000EnCW-2yfd for hostap@lists.infradead.org; Tue, 12 May 2026 13:21:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=infineon.com; i=@infineon.com; q=dns/txt; s=IFXMAIL; t=1778592110; x=1810128110; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=F+mIlm7+Ka6DRkC5Oc4jczHU1J8gT/ww+j0koIu+PSs=; b=euJpQILoRMoeU5BS4clDY54nQLsJBnxM1C91Z7bxvUBKR+RDw6qi57w2 pri/YHeM3bqZhaU90S6cmCFnyfDRb7ED+BcbfUflPgIDmoyVpA2GY1ZbQ bJSjDMk5IYhwGAkm+ac/6Se8s0eqVCukwUuhDYlVzNALdHN5hVxRTFNlP s=; X-CSE-ConnectionGUID: fywtFAWfSDy82p1uiFqtuQ== X-CSE-MsgGUID: wVlipoJiRq+L5TFgV3G5mg== X-IronPort-AV: E=McAfee;i="6800,10657,11783"; a="93096090" X-IronPort-AV: E=Sophos;i="6.23,230,1770591600"; d="scan'208";a="93096090" X-Amp-Result: SKIPPED(no attachment in message) Received: from unknown (HELO MUCSE822.infineon.com) ([172.23.29.53]) by smtp9.infineon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 May 2026 15:17:45 +0200 Received: from MUCSE825.infineon.com (172.23.29.18) by MUCSE822.infineon.com (172.23.29.53) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37; Tue, 12 May 2026 15:17:44 +0200 Received: from ISCN5CG4472QHC.infineon.com (10.161.6.196) by MUCSE825.infineon.com (172.23.29.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.37; Tue, 12 May 2026 15:17:43 +0200 From: Chung-Hsien Hsu To: CC: Chung-Hsien Hsu , R Sanath Kumar Subject: [PATCH 1/2] RSN: Reject invalid GTK KDE length in msg 3/4 Date: Tue, 12 May 2026 21:15:57 +0800 Message-ID: <20260512131558.18020-2-chung-hsien.hsu@infineon.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20260512131558.18020-1-chung-hsien.hsu@infineon.com> References: <20260512131558.18020-1-chung-hsien.hsu@infineon.com> MIME-Version: 1.0 X-Originating-IP: [10.161.6.196] X-ClientProxiedBy: MUCSE804.infineon.com (172.23.29.30) To MUCSE825.infineon.com (172.23.29.18) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260512_142150_228716_4B0A11C1 X-CRM114-Status: GOOD ( 16.23 ) X-Spam-Score: -2.5 (--) X-Spam-Report: Spam detection software, running on the system "desiato.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Validate the GTK KDE length in EAPOL-Key message 3/4 before transmitting message 4/4. The GTK KDE length is already checked when processing the GTK for installation. However, that validation is reached only after message 4/4 has been transmitted. This allows a malformed message 3/4 wit [...] Content analysis details: (-2.5 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at https://www.dnswl.org/, medium trust [217.10.52.204 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.0 DMARC_PASS DMARC pass policy X-BeenThere: hostap@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Hostap" Errors-To: hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org Validate the GTK KDE length in EAPOL-Key message 3/4 before transmitting message 4/4. The GTK KDE length is already checked when processing the GTK for installation. However, that validation is reached only after message 4/4 has been transmitted. This allows a malformed message 3/4 with an invalid GTK KDE length to be acknowledged even though the supplicant later rejects the GTK and fails the handshake. Reject message 3/4 before sending message 4/4 if the GTK KDE is too short to include the GTK KDE header, or if the GTK payload would exceed the local GTK buffer. Reuse the same helper in the later GTK installation path to keep the validation rules consistent. Signed-off-by: R Sanath Kumar Signed-off-by: Chung-Hsien Hsu --- src/rsn_supp/wpa.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c index 2c5ed11c8189..ecc0eddd45ab 100644 --- a/src/rsn_supp/wpa.c +++ b/src/rsn_supp/wpa.c @@ -1398,6 +1398,17 @@ struct wpa_gtk_data { }; +static int wpa_supplicant_validate_gtk_kde_len(size_t gtk_len) +{ + struct wpa_gtk_data gd; + + if (gtk_len < 2 || gtk_len - 2 > sizeof(gd.gtk)) + return -1; + + return 0; +} + + static int wpa_supplicant_install_gtk(struct wpa_sm *sm, const struct wpa_gtk_data *gd, const u8 *key_rsc, int wnm_sleep) @@ -1668,7 +1679,7 @@ static int wpa_supplicant_pairwise_gtk(struct wpa_sm *sm, wpa_hexdump_key(MSG_DEBUG, "RSN: received GTK in pairwise handshake", gtk, gtk_len); - if (gtk_len < 2 || gtk_len - 2 > sizeof(gd.gtk)) + if (wpa_supplicant_validate_gtk_kde_len(gtk_len) < 0) return -1; gd.keyidx = gtk[0] & 0x3; @@ -2892,6 +2903,15 @@ static void wpa_supplicant_process_3_of_4(struct wpa_sm *sm, "WPA: GTK IE in unencrypted key data"); goto failed; } + + if (!mlo && ie.gtk && + wpa_supplicant_validate_gtk_kde_len(ie.gtk_len) < 0) { + wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, + "WPA: Invalid GTK KDE length %lu", + (unsigned long) ie.gtk_len); + goto failed; + } + if (!mlo && ie.igtk && !(key_info & WPA_KEY_INFO_ENCR_KEY_DATA)) { wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, "WPA: IGTK KDE in unencrypted key data");