Fix validation of EAPOL-Key length with AES key wrap (CID 62859)

The additional eight octet field was removed from keydatalen without
proper validation of the Key Data Length field. It would have been
possible for an invalid EAPOL-Key frame to be processed in a way that
ends up reading beyond the buffer. In theory, this could have also
resulted in writing beyond the EAPOL-Key frame buffer, but that is
unlikely to be feasible due to the AES key wrap validation step on
arbitrary memory contents.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index ba2a8c87d5ed8fbc8cfdc63f05c162e6d41db9b2..d31de45672d181a1958202fdc7da920341b5a249 100644 (file)
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -1501,7 +1501,7 @@ static int wpa_supplicant_decrypt_key_data(struct wpa_sm *sm,
                   ver == WPA_KEY_INFO_TYPE_AES_128_CMAC ||
                   sm->key_mgmt == WPA_KEY_MGMT_OSEN) {
                u8 *buf;
-               if (keydatalen % 8) {
+               if (keydatalen < 8 || keydatalen % 8) {
                        wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
                                "WPA: Unsupported AES-WRAP len %d",
                                keydatalen);