diff mbox series

[SRU,Hirsute,Groovy,Focal/linux-oem-5.10,Focal/linux-oem-5.6,Focal,08/16] cfg80211: mitigate A-MSDU aggregation attacks

Message ID 20210525174625.69071-10-cascardo@canonical.com
State Accepted
Headers show
Series [SRU,Hirsute,Groovy,Focal/linux-oem-5.10,Focal/linux-oem-5.6,Focal,01/16] mac80211: assure all fragments are encrypted | expand

Commit Message

Thadeu Lima de Souza Cascardo May 25, 2021, 5:46 p.m. UTC 
From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>

Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the
destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP)
header, and if so dropping the complete A-MSDU frame. This mitigates
known attacks, although new (unknown) aggregation-based attacks may
remain possible.

This defense works because in A-MSDU aggregation injection attacks, a
normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
header. In other words, the destination MAC address of the first A-MSDU
subframe contains the start of an RFC1042 header during an aggregation
attack. We can detect this and thereby prevent this specific attack.
For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi
Through Frame Aggregation and Fragmentation".

Note that for kernel 4.9 and above this patch depends on "mac80211:
properly handle A-MSDUs that start with a rfc1042 header". Otherwise
this patch has no impact and attacks will remain possible.

Cc: stable@vger.kernel.org
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
Link: https://lore.kernel.org/r/20210511200110.25d93176ddaf.I9e265b597f2cd23eb44573f35b625947b386a9de@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 2b8a1fee3488c602aca8bea004a087e60806a5cf)
CVE-2020-24588
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
---
 net/wireless/util.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 03a5c8d30589..a83cb927d853 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -771,6 +771,9 @@  void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
 		remaining = skb->len - offset;
 		if (subframe_len > remaining)
 			goto purge;
+		/* mitigate A-MSDU aggregation injection attacks */
+		if (ether_addr_equal(eth.h_dest, rfc1042_header))
+			goto purge;
 
 		offset += sizeof(struct ethhdr);
 		last = remaining <= subframe_len + padding;