From 70ff850e89fbc8bc7da515321b4d15b5eef70581 Mon Sep 17 00:00:00 2001

From: Mathy Vanhoef <mathy.vanhoef@nyu.edu>

Date: Sun, 31 Mar 2019 17:13:06 +0200

Subject: [PATCH 11/14] EAP-pwd server: Verify received scalar and element

When processing an EAP-pwd Commit frame, the peer's scalar and element

(elliptic curve point) were not validated. This allowed an adversary to

bypass authentication, and impersonate any user if the crypto

implementation did not verify the validity of the EC point.

Fix this vulnerability by assuring the received scalar lies within the

valid range, and by checking that the received element is not the point

at infinity and lies on the elliptic curve being used. (CVE-2019-9498)

The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower

is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL

(and also BoringSSL) implicitly validate the elliptic curve point in

EC_POINT_set_affine_coordinates_GFp(), preventing the attack.

Signed-off-by: Mathy Vanhoef <mathy.vanhoef@nyu.edu>

---

 src/eap_server/eap_server_pwd.c | 20 ++++++++++++++++++++

 1 file changed, 20 insertions(+)

diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c

index d0fa54a..74979da 100644

--- a/src/eap_server/eap_server_pwd.c

+++ b/src/eap_server/eap_server_pwd.c

@@ -718,6 +718,26 @@ eap_pwd_process_commit_resp(struct eap_sm *sm, struct eap_pwd_data *data,

 		goto fin;

 	}

+	/* verify received scalar */

+	if (crypto_bignum_is_zero(data->peer_scalar) ||

+	    crypto_bignum_is_one(data->peer_scalar) ||

+	    crypto_bignum_cmp(data->peer_scalar,

+			      crypto_ec_get_order(data->grp->group)) >= 0) {

+		wpa_printf(MSG_INFO,

+			   "EAP-PWD (server): received scalar is invalid");

+		goto fin;

+	}

+

+	/* verify received element */

+	if (!crypto_ec_point_is_on_curve(data->grp->group,

+					 data->peer_element) ||

+	    crypto_ec_point_is_at_infinity(data->grp->group,

+					   data->peer_element)) {

+		wpa_printf(MSG_INFO,

+			   "EAP-PWD (server): received element is invalid");

+		goto fin;

+	}

+

 	/* check to ensure peer's element is not in a small sub-group */

 	if (!crypto_bignum_is_one(cofactor)) {

 		if (crypto_ec_point_mul(data->grp->group, data->peer_element,

-- 

2.7.4