Skip to content

Commit 76defa8

Browse files
CBL-Mariner-Botv-smalavathu
CBL-Mariner-Bot
and
v-smalavathu
authored
[AUTO-CHERRYPICK] [Medium] wpa_supplicant: Fix CVE-2023-52160 - branch 3.0-dev (#12612)
Co-authored-by: Sreenivasulu Malavathula (HCL Technologies Ltd) <[email protected]>
1 parent 1bce64c commit 76defa8

File tree

2 files changed

+185
-1
lines changed

2 files changed

+185
-1
lines changed

‎SPECS/wpa_supplicant/CVE-2023-52160.patch

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
From bd31011dbf906bb0eaf04cefb3076b0472dce422 Mon Sep 17 00:00:00 2001
2+
From: Sreenivasulu Malavathula <[email protected]>
3+
Date: Tue, 4 Feb 2025 10:44:41 -0600
4+
Subject: [PATCH] Address CVE-2023-52160
5+
6+
---
7+
src/eap_peer/eap_config.h | 8 ++++++
8+
src/eap_peer/eap_peap.c | 40 +++++++++++++++++++++++++++---
9+
src/eap_peer/eap_tls_common.c | 6 +++++
10+
src/eap_peer/eap_tls_common.h | 5 ++++
11+
wpa_supplicant/wpa_supplicant.conf | 7 ++++++
12+
5 files changed, 63 insertions(+), 3 deletions(-)
13+
14+
diff --git a/src/eap_peer/eap_config.h b/src/eap_peer/eap_config.h
15+
index 3238f74..047eec2 100644
16+
--- a/src/eap_peer/eap_config.h
17+
+++ b/src/eap_peer/eap_config.h
18+
@@ -469,6 +469,14 @@ struct eap_peer_config {
19+
* 1 = use cryptobinding if server supports it
20+
* 2 = require cryptobinding
21+
*
22+
+ * phase2_auth option can be used to control Phase 2 (i.e., within TLS
23+
+ * tunnel) behavior for PEAP:
24+
+ * 0 = do not require Phase 2 authentication
25+
+ * 1 = require Phase 2 authentication when client certificate
26+
+ * (private_key/client_cert) is no used and TLS session resumption was
27+
+ * not used (default)
28+
+ * 2 = require Phase 2 authentication in all cases
29+
+ *
30+
* EAP-WSC (WPS) uses following options: pin=Device_Password and
31+
* uuid=Device_UUID
32+
*
33+
diff --git a/src/eap_peer/eap_peap.c b/src/eap_peer/eap_peap.c
34+
index 12e30df..6080697 100644
35+
--- a/src/eap_peer/eap_peap.c
36+
+++ b/src/eap_peer/eap_peap.c
37+
@@ -67,6 +67,7 @@ struct eap_peap_data {
38+
u8 cmk[20];
39+
int soh; /* Whether IF-TNCCS-SOH (Statement of Health; Microsoft NAP)
40+
* is enabled. */
41+
+ enum { NO_AUTH, FOR_INITIAL, ALWAYS } phase2_auth;
42+
};
43+
44+
45+
@@ -114,6 +115,19 @@ static void eap_peap_parse_phase1(struct eap_peap_data *data,
46+
wpa_printf(MSG_DEBUG, "EAP-PEAP: Require cryptobinding");
47+
}
48+
49+
+ if (os_strstr(phase1, "phase2_auth=0")) {
50+
+ data->phase2_auth = NO_AUTH;
51+
+ wpa_printf(MSG_DEBUG,
52+
+ "EAP-PEAP: Do not require Phase 2 authentication");
53+
+ } else if (os_strstr(phase1, "phase2_auth=1")) {
54+
+ data->phase2_auth = FOR_INITIAL;
55+
+ wpa_printf(MSG_DEBUG,
56+
+ "EAP-PEAP: Require Phase 2 authentication for initial connection");
57+
+ } else if (os_strstr(phase1, "phase2_auth=2")) {
58+
+ data->phase2_auth = ALWAYS;
59+
+ wpa_printf(MSG_DEBUG,
60+
+ "EAP-PEAP: Require Phase 2 authentication for all cases");
61+
+ }
62+
#ifdef EAP_TNC
63+
if (os_strstr(phase1, "tnc=soh2")) {
64+
data->soh = 2;
65+
@@ -142,6 +156,7 @@ static void * eap_peap_init(struct eap_sm *sm)
66+
data->force_peap_version = -1;
67+
data->peap_outer_success = 2;
68+
data->crypto_binding = OPTIONAL_BINDING;
69+
+ data->phase2_auth = FOR_INITIAL;
70+
71+
if (config && config->phase1)
72+
eap_peap_parse_phase1(data, config->phase1);
73+
@@ -454,6 +469,20 @@ static int eap_tlv_validate_cryptobinding(struct eap_sm *sm,
74+
}
75+
76+
77+
+static bool peap_phase2_sufficient(struct eap_sm *sm,
78+
+ struct eap_peap_data *data)
79+
+{
80+
+ if ((data->phase2_auth == ALWAYS ||
81+
+ (data->phase2_auth == FOR_INITIAL &&
82+
+ !tls_connection_resumed(sm->ssl_ctx, data->ssl.conn) &&
83+
+ !data->ssl.client_cert_conf) ||
84+
+ data->phase2_eap_started) &&
85+
+ !data->phase2_eap_success)
86+
+ return false;
87+
+ return true;
88+
+}
89+
+
90+
+
91+
/**
92+
* eap_tlv_process - Process a received EAP-TLV message and generate a response
93+
* @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
94+
@@ -568,6 +597,11 @@ static int eap_tlv_process(struct eap_sm *sm, struct eap_peap_data *data,
95+
" - force failed Phase 2");
96+
resp_status = EAP_TLV_RESULT_FAILURE;
97+
ret->decision = DECISION_FAIL;
98+
+ } else if (!peap_phase2_sufficient(sm, data)) {
99+
+ wpa_printf(MSG_INFO,
100+
+ "EAP-PEAP: Server indicated Phase 2 success, but sufficient Phase 2 authentication has not been completed");
101+
+ resp_status = EAP_TLV_RESULT_FAILURE;
102+
+ ret->decision = DECISION_FAIL;
103+
} else {
104+
resp_status = EAP_TLV_RESULT_SUCCESS;
105+
ret->decision = DECISION_UNCOND_SUCC;
106+
@@ -887,8 +921,7 @@ continue_req:
107+
/* EAP-Success within TLS tunnel is used to indicate
108+
* shutdown of the TLS channel. The authentication has
109+
* been completed. */
110+
- if (data->phase2_eap_started &&
111+
- !data->phase2_eap_success) {
112+
+ if (!peap_phase2_sufficient(sm, data)) {
113+
wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 "
114+
"Success used to indicate success, "
115+
"but Phase 2 EAP was not yet "
116+
@@ -1199,8 +1232,9 @@ static struct wpabuf * eap_peap_process(struct eap_sm *sm, void *priv,
117+
static bool eap_peap_has_reauth_data(struct eap_sm *sm, void *priv)
118+
{
119+
struct eap_peap_data *data = priv;
120+
+
121+
return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
122+
- data->phase2_success;
123+
+ data->phase2_success && data->phase2_auth != ALWAYS;
124+
}
125+
126+
127+
diff --git a/src/eap_peer/eap_tls_common.c b/src/eap_peer/eap_tls_common.c
128+
index c1837db..a53eeb1 100644
129+
--- a/src/eap_peer/eap_tls_common.c
130+
+++ b/src/eap_peer/eap_tls_common.c
131+
@@ -239,6 +239,12 @@ static int eap_tls_params_from_conf(struct eap_sm *sm,
132+
133+
sm->ext_cert_check = !!(params->flags & TLS_CONN_EXT_CERT_CHECK);
134+
135+
+ if (!phase2)
136+
+ data->client_cert_conf = params->client_cert ||
137+
+ params->client_cert_blob ||
138+
+ params->private_key ||
139+
+ params->private_key_blob;
140+
+
141+
return 0;
142+
}
143+
144+
diff --git a/src/eap_peer/eap_tls_common.h b/src/eap_peer/eap_tls_common.h
145+
index 9ac0012..3348634 100644
146+
--- a/src/eap_peer/eap_tls_common.h
147+
+++ b/src/eap_peer/eap_tls_common.h
148+
@@ -79,6 +79,11 @@ struct eap_ssl_data {
149+
* tls_v13 - Whether TLS v1.3 or newer is used
150+
*/
151+
int tls_v13;
152+
+
153+
+ /**
154+
+ * client_cert_conf: Whether client certificate has been configured
155+
+ */
156+
+ bool client_cert_conf;
157+
};
158+
159+
160+
diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
161+
index 6619d6b..d63f73c 100644
162+
--- a/wpa_supplicant/wpa_supplicant.conf
163+
+++ b/wpa_supplicant/wpa_supplicant.conf
164+
@@ -1321,6 +1321,13 @@ fast_reauth=1
165+
# * 0 = do not use cryptobinding (default)
166+
# * 1 = use cryptobinding if server supports it
167+
# * 2 = require cryptobinding
168+
+# 'phase2_auth' option can be used to control Phase 2 (i.e., within TLS
169+
+# tunnel) behavior for PEAP:
170+
+# * 0 = do not require Phase 2 authentication
171+
+# * 1 = require Phase 2 authentication when client certificate
172+
+# (private_key/client_cert) is no used and TLS session resumption was
173+
+# not used (default)
174+
+# * 2 = require Phase 2 authentication in all cases
175+
# EAP-WSC (WPS) uses following options: pin=<Device Password> or
176+
# pbc=1.
177+
#
178+
--
179+
2.45.2
180+

‎SPECS/wpa_supplicant/wpa_supplicant.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
Summary: WPA client
22
Name: wpa_supplicant
33
Version: 2.10
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: BSD
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
88
Group: Applications/Communications
99
URL: https://w1.fi
1010
Source0: https://w1.fi/releases/%{name}-%{version}.tar.gz
11+
Patch0: CVE-2023-52160.patch
1112
BuildRequires: libnl3-devel
1213
BuildRequires: openssl-devel
1314
Requires: libnl3
@@ -95,6 +96,9 @@ EOF
9596
%{_sysconfdir}/wpa_supplicant/wpa_supplicant-wlan0.conf
9697

9798
%changelog
99+
* Wed Feb 03 2025 Sreeniavsulu Malavathula <[email protected]> - 2.10-2
100+
- Patch to fix CVE-2023-52160.
101+
98102
* Wed Jan 26 2022 Neha Agarwal <[email protected]> - 2.10-1
99103
- Upgrade to v2.10 to resolve CVE-2022-23303 and CVE-2022-23304.
100104
- License verified.

0 commit comments

Comments
 (0)