From 6b12d93d2c7428a34bfd4b3813ba339ed57b698a Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sun, 25 Oct 2015 15:45:50 +0200
Subject: [PATCH] WNM: Ignore Key Data in WNM Sleep Mode Response frame if no
 PMF in use

WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is
enabled. Verify that PMF is in use before using this field on station
side to avoid accepting unauthenticated key updates. (CVE-2015-5310)

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 wpa_supplicant/wnm_sta.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index 954de67..7d79499 100644
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -187,6 +187,12 @@ static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s,
 	end = ptr + key_len_total;
 	wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total);
 
+	if (key_len_total && !wpa_sm_pmf_enabled(wpa_s->wpa)) {
+		wpa_msg(wpa_s, MSG_INFO,
+			"WNM: Ignore Key Data in WNM-Sleep Mode Response - PMF not enabled");
+		return;
+	}
+
 	while (ptr + 1 < end) {
 		if (ptr + 2 + ptr[1] > end) {
 			wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element "
ller/connman.scm'>log</a><a href='/guix/tree/gnu/installer/connman.scm?id=ca86b0bae36063a136336700d94b278ed094250d'>tree</a><a href='/guix/commit/gnu/installer/connman.scm?id=ca86b0bae36063a136336700d94b278ed094250d'>commit</a><a href='/guix/diff/gnu/installer/connman.scm?id=ca86b0bae36063a136336700d94b278ed094250d'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/installer/connman.scm'>
<input type='hidden' name='id' value='ca86b0bae36063a136336700d94b278ed094250d'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=ca86b0bae36063a136336700d94b278ed094250d'>root</a>/<a href='/guix/log/gnu?id=ca86b0bae36063a136336700d94b278ed094250d'>gnu</a>/<a href='/guix/log/gnu/installer?id=ca86b0bae36063a136336700d94b278ed094250d'>installer</a>/<a href='/guix/log/gnu/installer/connman.scm?id=ca86b0bae36063a136336700d94b278ed094250d'>connman.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/installer/connman.scm?id=ca86b0bae36063a136336700d94b278ed094250d&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2019-02-18 01:52:47 +0100'>2019-02-18</span></td><td><a href='/guix/commit/gnu/installer/connman.scm?id=b83e4a93a2118513cdd2186d796729f0813264c0'>gnu: Fix some typos in the installer.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/installer/connman.scm (connman-connect-with-auth): Fix typo in
documentation.
* gnu/installer/newt/keymap.scm (sort-variants): Likewise.
* gnu/installer/newt/page.scm (run-listbox-selection-page): Likewise.
* gnu/installer/parted.scm (mkpart): Likewise.
* gnu/installer/newt/utils.scm (destroy-form-and-pop): Likewise.
* gnu/installer/newt/wifi.scm (run-unknown-error-page): Fix typo.
(wifi-listbox-heigth): Rename to…
(wifi-listbox-height): …this, and adjust caller.
* gnu/installer/timezone.scm (locate-childrens): Rename to…
(locate-children): …this.  Adjust all callers.
</span></span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2019-01-17 14:04:20 +0100'>2019-01-17</span></td><td><a href='/guix/commit/gnu/installer/connman.scm?id=d0f3a672dcbdfefd3556b6a21985ff0e35eed3be'>gnu: Add graphical installer support.</a><span class='msg-avail'>...<span class='msg-tooltip'>* configure.ac: Require that guile-newt is available.
* gnu/installer.scm: New file.
* gnu/installer/aux-files/logo.txt: New file.
* gnu/installer/build-installer.scm: New file.
* gnu/installer/connman.scm: New file.
* gnu/installer/keymap.scm: New file.
* gnu/installer/locale.scm: New file.
* gnu/installer/newt.scm: New file.
* gnu/installer/newt/ethernet.scm: New file.
* gnu/installer/newt/hostname.scm: New file.
* gnu/installer/newt/keymap.scm: New file.
* gnu/installer/newt/locale.scm: New file.
* gnu/installer/newt/menu.scm: New file.
* gnu/installer/newt/network.scm: New file.
* gnu/installer/newt/page.scm: New file.
* gnu/installer/newt/timezone.scm: New file.
* gnu/installer/newt/user.scm: New file.
* gnu/installer/newt/utils.scm: New file.
* gnu/installer/newt/welcome.scm: New file.
* gnu/installer/newt/wifi.scm: New file.
* gnu/installer/steps.scm: New file.
* gnu/installer/timezone.scm: New file.
* gnu/installer/utils.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add previous files.
* gnu/system.scm: Export %root-account.
* gnu/system/install.scm (%installation-services): Use kmscon instead of linux
VT for all tty.
(installation-os)[users]: Add the graphical installer as shell of the root
account.
[packages]: Add font related packages.
* po/guix/POTFILES.in: Add installer files.
</span></span></td><td>Mathieu Othacehe</td></tr>