oss-security - Re: wpa_supplicant P2P provision discovery processing vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YDnsmGZ4hL6knMJD@eldamar.lan>
Date: Sat, 27 Feb 2021 07:54:16 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: wpa_supplicant P2P provision discovery processing
 vulnerability

Hi,

On Thu, Feb 25, 2021 at 09:03:50PM +0200, Jouni Malinen wrote:
> Published: February 25, 2021
> Latest version available from: https://w1.fi/security/2021-1/
> 
> 
> Vulnerability
> 
> A vulnerability was discovered in how wpa_supplicant processes P2P
> (Wi-Fi Direct) provision discovery requests. Under a corner case
> condition, an invalid Provision Discovery Request frame could end up
> reaching a state where the oldest peer entry needs to be removed. With
> a suitably constructed invalid frame, this could result in use
> (read+write) of freed memory. This can result in an attacker within
> radio range of the device running P2P discovery being able to cause
> unexpected behavior, including termination of the wpa_supplicant process
> and potentially code execution.
> 
> 
> Vulnerable versions/configurations
> 
> wpa_supplicant v1.0-v2.9 with CONFIG_P2P build option enabled
> 
> An attacker (or a system controlled by the attacker) needs to be within
> radio range of the vulnerable system to send a set of suitably
> constructed management frames that trigger the corner case to be reached
> in the management of the P2P peer table.
> 
> 
> Possible mitigation steps
> 
> - Merge the following commit to wpa_supplicant and rebuild it:
> 
>   P2P: Fix a corner case in peer addition based on PD Request
>   
>   This patch is available from https://w1.fi/security/2021-1/
>   
> - Update to wpa_supplicant v2.10 or newer, once available
> 
> - Disable P2P (control interface command "P2P_SET disabled 1" or
>   "p2p_disabled=1" in (each, if multiple interfaces used) wpa_supplicant
>   configuration file)
> 
> - Disable P2P from the build (remove CONFIG_P2P=y)

CVE-2021-27803 is assigned for this issue:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27803

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.