[src/trunk]: src/external/bsd/wpa/dist/src CVE-2019-9498 (EAP-pwd server miss...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/77c6ce3323a1
branches:  trunk
changeset: 450329:77c6ce3323a1
user:      christos <christos%NetBSD.org@localhost>
date:      Wed Apr 10 17:48:07 2019 +0000

description:
CVE-2019-9498 (EAP-pwd server missing commit validation for scalar/element)
When processing an EAP-pwd Commit frame, the peer's scalar and element
(elliptic curve point) were not validated. This allowed an adversary to
bypass authentication, and impersonate any user if the crypto
implementation did not verify the validity of the EC point.

Fix this vulnerability by assuring the received scalar lies within the
valid range, and by checking that the received element is not the point
at infinity and lies on the elliptic curve being used. (CVE-2019-9498)

The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower
is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL
(and also BoringSSL) implicitly validate the elliptic curve point in
EC_POINT_set_affine_coordinates_GFp(), preventing the attack.

diffstat:

 external/bsd/wpa/dist/src/drivers/driver_bsd.c        |   2 +
 external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c |  20 +++++++++++++++++++
 2 files changed, 22 insertions(+), 0 deletions(-)

diffs (42 lines):

diff -r aaf45ead1da5 -r 77c6ce3323a1 external/bsd/wpa/dist/src/drivers/driver_bsd.c
--- a/external/bsd/wpa/dist/src/drivers/driver_bsd.c    Wed Apr 10 16:15:11 2019 +0000
+++ b/external/bsd/wpa/dist/src/drivers/driver_bsd.c    Wed Apr 10 17:48:07 2019 +0000
@@ -334,6 +334,8 @@
        mlme.im_op = op;
        mlme.im_reason = reason;
        os_memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
+       wpa_printf(MSG_DEBUG, "%s: op=%d reason=%d addr=" MACSTR, __func__,
+           op, reason, MAC2STR(addr));
        return set80211var(priv, IEEE80211_IOC_MLME, &mlme, sizeof(mlme));
 }
 
diff -r aaf45ead1da5 -r 77c6ce3323a1 external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c
--- a/external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c     Wed Apr 10 16:15:11 2019 +0000
+++ b/external/bsd/wpa/dist/src/eap_server/eap_server_pwd.c     Wed Apr 10 17:48:07 2019 +0000
@@ -718,6 +718,26 @@
                goto fin;
        }
 
+       /* verify received scalar */
+       if (crypto_bignum_is_zero(data->peer_scalar) ||
+           crypto_bignum_is_one(data->peer_scalar) ||
+           crypto_bignum_cmp(data->peer_scalar,
+                             crypto_ec_get_order(data->grp->group)) >= 0) {
+               wpa_printf(MSG_INFO,
+                          "EAP-PWD (server): received scalar is invalid");
+               goto fin;
+       }
+
+       /* verify received element */
+       if (!crypto_ec_point_is_on_curve(data->grp->group,
+                                        data->peer_element) ||
+           crypto_ec_point_is_at_infinity(data->grp->group,
+                                          data->peer_element)) {
+               wpa_printf(MSG_INFO,
+                          "EAP-PWD (server): received element is invalid");
+               goto fin;
+       }
+
        /* check to ensure peer's element is not in a small sub-group */
        if (!crypto_bignum_is_one(cofactor)) {
                if (crypto_ec_point_mul(data->grp->group, data->peer_element,