summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPeter Marko <peter.marko@siemens.com>2024-09-29 14:58:34 +0200
committerArmin Kuster <akuster808@gmail.com>2024-10-06 07:27:43 -0400
commitb2dc7d2aae9796edce300540b944774399df6ac3 (patch)
treeec7eaeb6a4e9f65dcc9280573b5568118f80618d
parent62b7dc247bdfd908abd6bbfc1c79a45358fb8e54 (diff)
downloadmeta-openembedded-b2dc7d2aae9796edce300540b944774399df6ac3.tar.gz
hostapd: Patch CVE-2024-3596
Picked patches according to http://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt First patch is style commit picked to have a clean cherry-pick of all mentioned commits without any conflict. Patch CVE-2024-3596_03.patch was removed as it only patched wpa_supplicant. The patch names were not changed so it is comparable with wpa_supplicant recipe. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat
-rw-r--r--meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_00.patch82
-rw-r--r--meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_01.patch165
-rw-r--r--meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_02.patch62
-rw-r--r--meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_04.patch52
-rw-r--r--meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_05.patch51
-rw-r--r--meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_06.patch46
-rw-r--r--meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_07.patch105
-rw-r--r--meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_08.patch47
-rw-r--r--meta-oe/recipes-connectivity/hostapd/hostapd_2.10.bb8
9 files changed, 618 insertions, 0 deletions
diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_00.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_00.patch
new file mode 100644
index 0000000000..7a8197d2b4
--- /dev/null
+++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_00.patch
@@ -0,0 +1,82 @@
1From 945acf3ef06a6c312927da4fa055693dbac432d1 Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <j@w1.fi>
3Date: Sat, 2 Apr 2022 16:28:12 +0300
4Subject: [PATCH 1/9] ieee802_11_auth: Coding style cleanup - no string
5 constant splitting
6
7Signed-off-by: Jouni Malinen <j@w1.fi>
8
9Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=945acf3ef06a6c312927da4fa055693dbac432d1]
10Signed-off-by: Peter Marko <peter.marko@siemens.com>
11---
12 src/ap/ieee802_11_auth.c | 27 +++++++++++++++------------
13 1 file changed, 15 insertions(+), 12 deletions(-)
14
15diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c
16index 783ee6dea..47cc625be 100644
17--- a/src/ap/ieee802_11_auth.c
18+++ b/src/ap/ieee802_11_auth.c
19@@ -267,16 +267,16 @@ int hostapd_allowed_address(struct hostapd_data *hapd, const u8 *addr,
20 os_get_reltime(&query->timestamp);
21 os_memcpy(query->addr, addr, ETH_ALEN);
22 if (hostapd_radius_acl_query(hapd, addr, query)) {
23- wpa_printf(MSG_DEBUG, "Failed to send Access-Request "
24- "for ACL query.");
25+ wpa_printf(MSG_DEBUG,
26+ "Failed to send Access-Request for ACL query.");
27 hostapd_acl_query_free(query);
28 return HOSTAPD_ACL_REJECT;
29 }
30
31 query->auth_msg = os_memdup(msg, len);
32 if (query->auth_msg == NULL) {
33- wpa_printf(MSG_ERROR, "Failed to allocate memory for "
34- "auth frame.");
35+ wpa_printf(MSG_ERROR,
36+ "Failed to allocate memory for auth frame.");
37 hostapd_acl_query_free(query);
38 return HOSTAPD_ACL_REJECT;
39 }
40@@ -467,19 +467,21 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req,
41 if (query == NULL)
42 return RADIUS_RX_UNKNOWN;
43
44- wpa_printf(MSG_DEBUG, "Found matching Access-Request for RADIUS "
45- "message (id=%d)", query->radius_id);
46+ wpa_printf(MSG_DEBUG,
47+ "Found matching Access-Request for RADIUS message (id=%d)",
48+ query->radius_id);
49
50 if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) {
51- wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have "
52- "correct authenticator - dropped\n");
53+ wpa_printf(MSG_INFO,
54+ "Incoming RADIUS packet did not have correct authenticator - dropped");
55 return RADIUS_RX_INVALID_AUTHENTICATOR;
56 }
57
58 if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
59 hdr->code != RADIUS_CODE_ACCESS_REJECT) {
60- wpa_printf(MSG_DEBUG, "Unknown RADIUS message code %d to ACL "
61- "query", hdr->code);
62+ wpa_printf(MSG_DEBUG,
63+ "Unknown RADIUS message code %d to ACL query",
64+ hdr->code);
65 return RADIUS_RX_UNKNOWN;
66 }
67
68@@ -506,8 +508,9 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req,
69 msg, RADIUS_ATTR_ACCT_INTERIM_INTERVAL,
70 &info->acct_interim_interval) == 0 &&
71 info->acct_interim_interval < 60) {
72- wpa_printf(MSG_DEBUG, "Ignored too small "
73- "Acct-Interim-Interval %d for STA " MACSTR,
74+ wpa_printf(MSG_DEBUG,
75+ "Ignored too small Acct-Interim-Interval %d for STA "
76+ MACSTR,
77 info->acct_interim_interval,
78 MAC2STR(query->addr));
79 info->acct_interim_interval = 0;
80--
812.30.2
82
diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_01.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_01.patch
new file mode 100644
index 0000000000..dab2eedd6a
--- /dev/null
+++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_01.patch
@@ -0,0 +1,165 @@
1From adac846bd0e258a0aa50750bbd2b411fa0085c46 Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <j@w1.fi>
3Date: Sat, 16 Mar 2024 11:11:44 +0200
4Subject: [PATCH 2/9] RADIUS: Allow Message-Authenticator attribute as the
5 first attribute
6
7If a Message-Authenticator attribute was already added to a RADIUS
8message, use that attribute instead of adding a new one when finishing
9message building. This allows the Message-Authenticator attribute to be
10placed as the first attribute in the message.
11
12Signed-off-by: Jouni Malinen <j@w1.fi>
13
14CVE: CVE-2024-3596
15Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=adac846bd0e258a0aa50750bbd2b411fa0085c46]
16Signed-off-by: Peter Marko <peter.marko@siemens.com>
17---
18 src/radius/radius.c | 85 ++++++++++++++++++++++++++++-----------------
19 src/radius/radius.h | 1 +
20 2 files changed, 54 insertions(+), 32 deletions(-)
21
22diff --git a/src/radius/radius.c b/src/radius/radius.c
23index be16e27b9..2d2e00b5c 100644
24--- a/src/radius/radius.c
25+++ b/src/radius/radius.c
26@@ -364,25 +364,54 @@ void radius_msg_dump(struct radius_msg *msg)
27 }
28
29
30+u8 * radius_msg_add_msg_auth(struct radius_msg *msg)
31+{
32+ u8 auth[MD5_MAC_LEN];
33+ struct radius_attr_hdr *attr;
34+
35+ os_memset(auth, 0, MD5_MAC_LEN);
36+ attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR,
37+ auth, MD5_MAC_LEN);
38+ if (!attr) {
39+ wpa_printf(MSG_ERROR,
40+ "WARNING: Could not add Message-Authenticator");
41+ return NULL;
42+ }
43+
44+ return (u8 *) (attr + 1);
45+}
46+
47+
48+static u8 * radius_msg_auth_pos(struct radius_msg *msg)
49+{
50+ u8 *pos;
51+ size_t alen;
52+
53+ if (radius_msg_get_attr_ptr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR,
54+ &pos, &alen, NULL) == 0 &&
55+ alen == MD5_MAC_LEN) {
56+ /* Use already added Message-Authenticator attribute */
57+ return pos;
58+ }
59+
60+ /* Add a Message-Authenticator attribute */
61+ return radius_msg_add_msg_auth(msg);
62+}
63+
64+
65 int radius_msg_finish(struct radius_msg *msg, const u8 *secret,
66 size_t secret_len)
67 {
68 if (secret) {
69- u8 auth[MD5_MAC_LEN];
70- struct radius_attr_hdr *attr;
71+ u8 *pos;
72
73- os_memset(auth, 0, MD5_MAC_LEN);
74- attr = radius_msg_add_attr(msg,
75- RADIUS_ATTR_MESSAGE_AUTHENTICATOR,
76- auth, MD5_MAC_LEN);
77- if (attr == NULL) {
78- wpa_printf(MSG_WARNING, "RADIUS: Could not add "
79- "Message-Authenticator");
80+ pos = radius_msg_auth_pos(msg);
81+ if (!pos)
82 return -1;
83- }
84 msg->hdr->length = host_to_be16(wpabuf_len(msg->buf));
85- hmac_md5(secret, secret_len, wpabuf_head(msg->buf),
86- wpabuf_len(msg->buf), (u8 *) (attr + 1));
87+ if (hmac_md5(secret, secret_len, wpabuf_head(msg->buf),
88+ wpabuf_len(msg->buf), pos) < 0)
89+ return -1;
90 } else
91 msg->hdr->length = host_to_be16(wpabuf_len(msg->buf));
92
93@@ -398,23 +427,19 @@ int radius_msg_finish(struct radius_msg *msg, const u8 *secret,
94 int radius_msg_finish_srv(struct radius_msg *msg, const u8 *secret,
95 size_t secret_len, const u8 *req_authenticator)
96 {
97- u8 auth[MD5_MAC_LEN];
98- struct radius_attr_hdr *attr;
99 const u8 *addr[4];
100 size_t len[4];
101+ u8 *pos;
102
103- os_memset(auth, 0, MD5_MAC_LEN);
104- attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR,
105- auth, MD5_MAC_LEN);
106- if (attr == NULL) {
107- wpa_printf(MSG_ERROR, "WARNING: Could not add Message-Authenticator");
108+ pos = radius_msg_auth_pos(msg);
109+ if (!pos)
110 return -1;
111- }
112 msg->hdr->length = host_to_be16(wpabuf_len(msg->buf));
113 os_memcpy(msg->hdr->authenticator, req_authenticator,
114 sizeof(msg->hdr->authenticator));
115- hmac_md5(secret, secret_len, wpabuf_head(msg->buf),
116- wpabuf_len(msg->buf), (u8 *) (attr + 1));
117+ if (hmac_md5(secret, secret_len, wpabuf_head(msg->buf),
118+ wpabuf_len(msg->buf), pos) < 0)
119+ return -1;
120
121 /* ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret) */
122 addr[0] = (u8 *) msg->hdr;
123@@ -442,21 +467,17 @@ int radius_msg_finish_das_resp(struct radius_msg *msg, const u8 *secret,
124 {
125 const u8 *addr[2];
126 size_t len[2];
127- u8 auth[MD5_MAC_LEN];
128- struct radius_attr_hdr *attr;
129+ u8 *pos;
130
131- os_memset(auth, 0, MD5_MAC_LEN);
132- attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR,
133- auth, MD5_MAC_LEN);
134- if (attr == NULL) {
135- wpa_printf(MSG_WARNING, "Could not add Message-Authenticator");
136+ pos = radius_msg_auth_pos(msg);
137+ if (!pos)
138 return -1;
139- }
140
141 msg->hdr->length = host_to_be16(wpabuf_len(msg->buf));
142 os_memcpy(msg->hdr->authenticator, req_hdr->authenticator, 16);
143- hmac_md5(secret, secret_len, wpabuf_head(msg->buf),
144- wpabuf_len(msg->buf), (u8 *) (attr + 1));
145+ if (hmac_md5(secret, secret_len, wpabuf_head(msg->buf),
146+ wpabuf_len(msg->buf), pos) < 0)
147+ return -1;
148
149 /* ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret) */
150 addr[0] = wpabuf_head_u8(msg->buf);
151diff --git a/src/radius/radius.h b/src/radius/radius.h
152index fb8148180..6b9dfbca2 100644
153--- a/src/radius/radius.h
154+++ b/src/radius/radius.h
155@@ -240,6 +240,7 @@ struct wpabuf * radius_msg_get_buf(struct radius_msg *msg);
156 struct radius_msg * radius_msg_new(u8 code, u8 identifier);
157 void radius_msg_free(struct radius_msg *msg);
158 void radius_msg_dump(struct radius_msg *msg);
159+u8 * radius_msg_add_msg_auth(struct radius_msg *msg);
160 int radius_msg_finish(struct radius_msg *msg, const u8 *secret,
161 size_t secret_len);
162 int radius_msg_finish_srv(struct radius_msg *msg, const u8 *secret,
163--
1642.30.2
165
diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_02.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_02.patch
new file mode 100644
index 0000000000..02e35bd6de
--- /dev/null
+++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_02.patch
@@ -0,0 +1,62 @@
1From 54abb0d3cf35894e7d86e3f7555e95b106306803 Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <j@w1.fi>
3Date: Sat, 16 Mar 2024 11:13:32 +0200
4Subject: [PATCH 3/9] RADIUS server: Place Message-Authenticator attribute as
5 the first one
6
7Move the Message-Authenticator attribute to be the first attribute in
8the RADIUS messages. This mitigates certain MD5 attacks against
9RADIUS/UDP.
10
11Signed-off-by: Jouni Malinen <j@w1.fi>
12
13CVE: CVE-2024-3596
14Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=54abb0d3cf35894e7d86e3f7555e95b106306803]
15Signed-off-by: Peter Marko <peter.marko@siemens.com>
16---
17 src/radius/radius_server.c | 15 +++++++++++++++
18 1 file changed, 15 insertions(+)
19
20diff --git a/src/radius/radius_server.c b/src/radius/radius_server.c
21index e02c21540..fa3691548 100644
22--- a/src/radius/radius_server.c
23+++ b/src/radius/radius_server.c
24@@ -920,6 +920,11 @@ radius_server_encapsulate_eap(struct radius_server_data *data,
25 return NULL;
26 }
27
28+ if (!radius_msg_add_msg_auth(msg)) {
29+ radius_msg_free(msg);
30+ return NULL;
31+ }
32+
33 sess_id = htonl(sess->sess_id);
34 if (code == RADIUS_CODE_ACCESS_CHALLENGE &&
35 !radius_msg_add_attr(msg, RADIUS_ATTR_STATE,
36@@ -1204,6 +1209,11 @@ radius_server_macacl(struct radius_server_data *data,
37 return NULL;
38 }
39
40+ if (!radius_msg_add_msg_auth(msg)) {
41+ radius_msg_free(msg);
42+ return NULL;
43+ }
44+
45 if (radius_msg_copy_attr(msg, request, RADIUS_ATTR_PROXY_STATE) < 0) {
46 RADIUS_DEBUG("Failed to copy Proxy-State attribute(s)");
47 radius_msg_free(msg);
48@@ -1253,6 +1263,11 @@ static int radius_server_reject(struct radius_server_data *data,
49 return -1;
50 }
51
52+ if (!radius_msg_add_msg_auth(msg)) {
53+ radius_msg_free(msg);
54+ return -1;
55+ }
56+
57 os_memset(&eapfail, 0, sizeof(eapfail));
58 eapfail.code = EAP_CODE_FAILURE;
59 eapfail.identifier = 0;
60--
612.30.2
62
diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_04.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_04.patch
new file mode 100644
index 0000000000..ce499ce8b6
--- /dev/null
+++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_04.patch
@@ -0,0 +1,52 @@
1From 37fe8e48ab44d44fe3cf5dd8f52cb0a10be0cd17 Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <j@w1.fi>
3Date: Sat, 16 Mar 2024 11:22:43 +0200
4Subject: [PATCH 5/9] hostapd: Move Message-Authenticator attribute to be the
5 first one in req
6
7Even if this is not strictly speaking necessary for mitigating certain
8RADIUS protocol attacks, be consistent with the RADIUS server behavior
9and move the Message-Authenticator attribute to be the first attribute
10in the message from RADIUS client in hostapd.
11
12Signed-off-by: Jouni Malinen <j@w1.fi>
13
14CVE: CVE-2024-3596
15Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=37fe8e48ab44d44fe3cf5dd8f52cb0a10be0cd17]
16Signed-off-by: Peter Marko <peter.marko@siemens.com>
17---
18 src/ap/ieee802_11_auth.c | 3 +++
19 src/ap/ieee802_1x.c | 3 +++
20 2 files changed, 6 insertions(+)
21
22diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c
23index 47cc625be..2a950cf7f 100644
24--- a/src/ap/ieee802_11_auth.c
25+++ b/src/ap/ieee802_11_auth.c
26@@ -119,6 +119,9 @@ static int hostapd_radius_acl_query(struct hostapd_data *hapd, const u8 *addr,
27 goto fail;
28 }
29
30+ if (!radius_msg_add_msg_auth(msg))
31+ goto fail;
32+
33 os_snprintf(buf, sizeof(buf), RADIUS_ADDR_FORMAT, MAC2STR(addr));
34 if (!radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, (u8 *) buf,
35 os_strlen(buf))) {
36diff --git a/src/ap/ieee802_1x.c b/src/ap/ieee802_1x.c
37index 753c88335..89e3dd30e 100644
38--- a/src/ap/ieee802_1x.c
39+++ b/src/ap/ieee802_1x.c
40@@ -702,6 +702,9 @@ void ieee802_1x_encapsulate_radius(struct hostapd_data *hapd,
41 goto fail;
42 }
43
44+ if (!radius_msg_add_msg_auth(msg))
45+ goto fail;
46+
47 if (sm->identity &&
48 !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME,
49 sm->identity, sm->identity_len)) {
50--
512.30.2
52
diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_05.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_05.patch
new file mode 100644
index 0000000000..44113afd4a
--- /dev/null
+++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_05.patch
@@ -0,0 +1,51 @@
1From f54157077f799d84ce26bed6ad6b01c4a16e31cf Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <j@w1.fi>
3Date: Sat, 16 Mar 2024 11:26:58 +0200
4Subject: [PATCH 6/9] RADIUS DAS: Move Message-Authenticator attribute to be
5 the first one
6
7Even if this might not be strictly speaking necessary for mitigating
8certain RADIUS protocol attacks, be consistent with the RADIUS server
9behavior and move the Message-Authenticator attribute to be the first
10attribute in the RADIUS DAS responses from hostapd.
11
12Signed-off-by: Jouni Malinen <j@w1.fi>
13
14CVE: CVE-2024-3596
15Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=f54157077f799d84ce26bed6ad6b01c4a16e31cf]
16Signed-off-by: Peter Marko <peter.marko@siemens.com>
17---
18 src/radius/radius_das.c | 10 ++++++++++
19 1 file changed, 10 insertions(+)
20
21diff --git a/src/radius/radius_das.c b/src/radius/radius_das.c
22index aaa3fc267..8d7c9b4c4 100644
23--- a/src/radius/radius_das.c
24+++ b/src/radius/radius_das.c
25@@ -177,6 +177,11 @@ fail:
26 if (reply == NULL)
27 return NULL;
28
29+ if (!radius_msg_add_msg_auth(reply)) {
30+ radius_msg_free(reply);
31+ return NULL;
32+ }
33+
34 if (error) {
35 if (!radius_msg_add_attr_int32(reply, RADIUS_ATTR_ERROR_CAUSE,
36 error)) {
37@@ -368,6 +373,11 @@ fail:
38 if (!reply)
39 return NULL;
40
41+ if (!radius_msg_add_msg_auth(reply)) {
42+ radius_msg_free(reply);
43+ return NULL;
44+ }
45+
46 if (error &&
47 !radius_msg_add_attr_int32(reply, RADIUS_ATTR_ERROR_CAUSE, error)) {
48 radius_msg_free(reply);
49--
502.30.2
51
diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_06.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_06.patch
new file mode 100644
index 0000000000..9a284b5261
--- /dev/null
+++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_06.patch
@@ -0,0 +1,46 @@
1From 934b0c3a45ce0726560ccefbd992a9d385c36385 Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <j@w1.fi>
3Date: Sat, 16 Mar 2024 11:31:37 +0200
4Subject: [PATCH 7/9] Require Message-Authenticator in Access-Reject even
5 without EAP-Message
6
7Do not allow the exception for missing Message-Authenticator in
8Access-Reject without EAP-Message. While such exception is allowed in
9RADIUS definition, there is no strong reason to maintain this since
10Access-Reject is supposed to include EAP-Message and even if it doesn't,
11discarding Access-Reject will result in the connection not completing.
12
13Signed-off-by: Jouni Malinen <j@w1.fi>
14
15CVE: CVE-2024-3596
16Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=934b0c3a45ce0726560ccefbd992a9d385c36385]
17Signed-off-by: Peter Marko <peter.marko@siemens.com>
18---
19 src/ap/ieee802_1x.c | 11 +----------
20 1 file changed, 1 insertion(+), 10 deletions(-)
21
22diff --git a/src/ap/ieee802_1x.c b/src/ap/ieee802_1x.c
23index 89e3dd30e..6e7b75128 100644
24--- a/src/ap/ieee802_1x.c
25+++ b/src/ap/ieee802_1x.c
26@@ -1939,16 +1939,7 @@ ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req,
27 }
28 sta = sm->sta;
29
30- /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
31- * present when packet contains an EAP-Message attribute */
32- if (hdr->code == RADIUS_CODE_ACCESS_REJECT &&
33- radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL,
34- 0) < 0 &&
35- radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) {
36- wpa_printf(MSG_DEBUG,
37- "Allowing RADIUS Access-Reject without Message-Authenticator since it does not include EAP-Message");
38- } else if (radius_msg_verify(msg, shared_secret, shared_secret_len,
39- req, 1)) {
40+ if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 1)) {
41 wpa_printf(MSG_INFO,
42 "Incoming RADIUS packet did not have correct Message-Authenticator - dropped");
43 return RADIUS_RX_INVALID_AUTHENTICATOR;
44--
452.30.2
46
diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_07.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_07.patch
new file mode 100644
index 0000000000..78d3f5d591
--- /dev/null
+++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_07.patch
@@ -0,0 +1,105 @@
1From 58097123ec5ea6f8276b38cb9b07669ec368a6c1 Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <j@w1.fi>
3Date: Sun, 17 Mar 2024 10:42:56 +0200
4Subject: [PATCH 8/9] RADIUS: Require Message-Authenticator attribute in MAC
5 ACL cases
6
7hostapd required Message-Authenticator attribute to be included in EAP
8authentication cases, but that requirement was not in place for MAC ACL
9cases. Start requiring Message-Authenticator attribute for MAC ACL by
10default. Unlike the EAP case, this can still be disabled with
11radius_require_message_authenticator=1 to maintain compatibility with
12some RADIUS servers when used in a network where the connection to such
13a server is secure.
14
15Signed-off-by: Jouni Malinen <j@w1.fi>
16
17CVE: CVE-2024-3596
18Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=58097123ec5ea6f8276b38cb9b07669ec368a6c1]
19Signed-off-by: Peter Marko <peter.marko@siemens.com>
20---
21 hostapd/config_file.c | 3 +++
22 hostapd/hostapd.conf | 11 +++++++++++
23 src/ap/ap_config.c | 1 +
24 src/ap/ap_config.h | 1 +
25 src/ap/ieee802_11_auth.c | 4 +++-
26 5 files changed, 19 insertions(+), 1 deletion(-)
27
28diff --git a/hostapd/config_file.c b/hostapd/config_file.c
29index b14728d1b..af1e81d1d 100644
30--- a/hostapd/config_file.c
31+++ b/hostapd/config_file.c
32@@ -2806,6 +2806,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
33 bss->radius->acct_server->shared_secret_len = len;
34 } else if (os_strcmp(buf, "radius_retry_primary_interval") == 0) {
35 bss->radius->retry_primary_interval = atoi(pos);
36+ } else if (os_strcmp(buf,
37+ "radius_require_message_authenticator") == 0) {
38+ bss->radius_require_message_authenticator = atoi(pos);
39 } else if (os_strcmp(buf, "radius_acct_interim_interval") == 0) {
40 bss->acct_interim_interval = atoi(pos);
41 } else if (os_strcmp(buf, "radius_request_cui") == 0) {
42diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
43index 3c2019f73..c055946a6 100644
44--- a/hostapd/hostapd.conf
45+++ b/hostapd/hostapd.conf
46@@ -1447,6 +1447,17 @@ own_ip_addr=127.0.0.1
47 # currently used secondary server is still working.
48 #radius_retry_primary_interval=600
49
50+# Message-Authenticator attribute requirement for non-EAP cases
51+# hostapd requires Message-Authenticator attribute to be included in all cases
52+# where RADIUS is used for EAP authentication. This is also required for cases
53+# where RADIUS is used for MAC ACL (macaddr_acl=2) by default, but that case
54+# can be configured to not require this for compatibility with RADIUS servers
55+# that do not include the attribute. This is not recommended due to potential
56+# security concerns, but can be used as a temporary workaround in networks where
57+# the connection to the RADIUS server is secure.
58+# 0 = Do not require Message-Authenticator in MAC ACL response
59+# 1 = Require Message-Authenticator in all authentication cases (default)
60+#radius_require_message_authenticator=1
61
62 # Interim accounting update interval
63 # If this is set (larger than 0) and acct_server is configured, hostapd will
64diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
65index 86b6e097c..cf497a180 100644
66--- a/src/ap/ap_config.c
67+++ b/src/ap/ap_config.c
68@@ -120,6 +120,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
69 #endif /* CONFIG_IEEE80211R_AP */
70
71 bss->radius_das_time_window = 300;
72+ bss->radius_require_message_authenticator = 1;
73
74 bss->anti_clogging_threshold = 5;
75 bss->sae_sync = 5;
76diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
77index 49cd3168a..22ad617f4 100644
78--- a/src/ap/ap_config.h
79+++ b/src/ap/ap_config.h
80@@ -302,6 +302,7 @@ struct hostapd_bss_config {
81 struct hostapd_ip_addr own_ip_addr;
82 char *nas_identifier;
83 struct hostapd_radius_servers *radius;
84+ int radius_require_message_authenticator;
85 int acct_interim_interval;
86 int radius_request_cui;
87 struct hostapd_radius_attr *radius_auth_req_attr;
88diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c
89index 2a950cf7f..dab9bcde3 100644
90--- a/src/ap/ieee802_11_auth.c
91+++ b/src/ap/ieee802_11_auth.c
92@@ -474,7 +474,9 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req,
93 "Found matching Access-Request for RADIUS message (id=%d)",
94 query->radius_id);
95
96- if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) {
97+ if (radius_msg_verify(
98+ msg, shared_secret, shared_secret_len, req,
99+ hapd->conf->radius_require_message_authenticator)) {
100 wpa_printf(MSG_INFO,
101 "Incoming RADIUS packet did not have correct authenticator - dropped");
102 return RADIUS_RX_INVALID_AUTHENTICATOR;
103--
1042.30.2
105
diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_08.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_08.patch
new file mode 100644
index 0000000000..e23d1e0047
--- /dev/null
+++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2024-3596_08.patch
@@ -0,0 +1,47 @@
1From f302d9f9646704cce745734af21d540baa0da65f Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <j@w1.fi>
3Date: Sun, 17 Mar 2024 10:47:58 +0200
4Subject: [PATCH 9/9] RADIUS: Check Message-Authenticator if it is present even
5 if not required
6
7Always check the Message-Authenticator attribute in a received RADIUS
8message if it is present. Previously, this would have been skipped if
9the attribute was not required to be present.
10
11Signed-off-by: Jouni Malinen <j@w1.fi>
12
13CVE: CVE-2024-3596
14Upstream-Status: Backport [https://w1.fi/cgit/hostap/commit/?id=f302d9f9646704cce745734af21d540baa0da65f]
15Signed-off-by: Peter Marko <peter.marko@siemens.com>
16---
17 src/radius/radius.c | 14 ++++++++++++++
18 1 file changed, 14 insertions(+)
19
20diff --git a/src/radius/radius.c b/src/radius/radius.c
21index 2d2e00b5c..a0e3ce399 100644
22--- a/src/radius/radius.c
23+++ b/src/radius/radius.c
24@@ -879,6 +879,20 @@ int radius_msg_verify(struct radius_msg *msg, const u8 *secret,
25 return 1;
26 }
27
28+ if (!auth) {
29+ u8 *pos;
30+ size_t alen;
31+
32+ if (radius_msg_get_attr_ptr(msg,
33+ RADIUS_ATTR_MESSAGE_AUTHENTICATOR,
34+ &pos, &alen, NULL) == 0) {
35+ /* Check the Message-Authenticator attribute since it
36+ * was included even if we are configured to not
37+ * require it. */
38+ auth = 1;
39+ }
40+ }
41+
42 if (auth &&
43 radius_msg_verify_msg_auth(msg, secret, secret_len,
44 sent_msg->hdr->authenticator)) {
45--
462.30.2
47
diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd_2.10.bb b/meta-oe/recipes-connectivity/hostapd/hostapd_2.10.bb
index 3c5f78f91a..70fac06d89 100644
--- a/meta-oe/recipes-connectivity/hostapd/hostapd_2.10.bb
+++ b/meta-oe/recipes-connectivity/hostapd/hostapd_2.10.bb
@@ -11,6 +11,14 @@ SRC_URI = " \
11 file://defconfig \ 11 file://defconfig \
12 file://init \ 12 file://init \
13 file://hostapd.service \ 13 file://hostapd.service \
14 file://CVE-2024-3596_00.patch \
15 file://CVE-2024-3596_01.patch \
16 file://CVE-2024-3596_02.patch \
17 file://CVE-2024-3596_04.patch \
18 file://CVE-2024-3596_05.patch \
19 file://CVE-2024-3596_06.patch \
20 file://CVE-2024-3596_07.patch \
21 file://CVE-2024-3596_08.patch \
14" 22"
15 23
16 24
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-26 04:52:20 +0000