|
John W. Linville |
aeb7fa6 |
From 70ff850e89fbc8bc7da515321b4d15b5eef70581 Mon Sep 17 00:00:00 2001
|
|
John W. Linville |
aeb7fa6 |
From: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
|
|
John W. Linville |
aeb7fa6 |
Date: Sun, 31 Mar 2019 17:13:06 +0200
|
|
John W. Linville |
aeb7fa6 |
Subject: [PATCH 11/14] EAP-pwd server: Verify received scalar and element
|
|
John W. Linville |
aeb7fa6 |
|
|
John W. Linville |
aeb7fa6 |
When processing an EAP-pwd Commit frame, the peer's scalar and element
|
|
John W. Linville |
aeb7fa6 |
(elliptic curve point) were not validated. This allowed an adversary to
|
|
John W. Linville |
aeb7fa6 |
bypass authentication, and impersonate any user if the crypto
|
|
John W. Linville |
aeb7fa6 |
implementation did not verify the validity of the EC point.
|
|
John W. Linville |
aeb7fa6 |
|
|
John W. Linville |
aeb7fa6 |
Fix this vulnerability by assuring the received scalar lies within the
|
|
John W. Linville |
aeb7fa6 |
valid range, and by checking that the received element is not the point
|
|
John W. Linville |
aeb7fa6 |
at infinity and lies on the elliptic curve being used. (CVE-2019-9498)
|
|
John W. Linville |
aeb7fa6 |
|
|
John W. Linville |
aeb7fa6 |
The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower
|
|
John W. Linville |
aeb7fa6 |
is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL
|
|
John W. Linville |
aeb7fa6 |
(and also BoringSSL) implicitly validate the elliptic curve point in
|
|
John W. Linville |
aeb7fa6 |
EC_POINT_set_affine_coordinates_GFp(), preventing the attack.
|
|
John W. Linville |
aeb7fa6 |
|
|
John W. Linville |
aeb7fa6 |
Signed-off-by: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
|
|
John W. Linville |
aeb7fa6 |
---
|
|
John W. Linville |
aeb7fa6 |
src/eap_server/eap_server_pwd.c | 20 ++++++++++++++++++++
|
|
John W. Linville |
aeb7fa6 |
1 file changed, 20 insertions(+)
|
|
John W. Linville |
aeb7fa6 |
|
|
John W. Linville |
aeb7fa6 |
diff --git a/src/eap_server/eap_server_pwd.c b/src/eap_server/eap_server_pwd.c
|
|
John W. Linville |
aeb7fa6 |
index d0fa54a..74979da 100644
|
|
John W. Linville |
aeb7fa6 |
--- a/src/eap_server/eap_server_pwd.c
|
|
John W. Linville |
aeb7fa6 |
+++ b/src/eap_server/eap_server_pwd.c
|
|
John W. Linville |
aeb7fa6 |
@@ -718,6 +718,26 @@ eap_pwd_process_commit_resp(struct eap_sm *sm, struct eap_pwd_data *data,
|
|
John W. Linville |
aeb7fa6 |
goto fin;
|
|
John W. Linville |
aeb7fa6 |
}
|
|
John W. Linville |
aeb7fa6 |
|
|
John W. Linville |
aeb7fa6 |
+ /* verify received scalar */
|
|
John W. Linville |
aeb7fa6 |
+ if (crypto_bignum_is_zero(data->peer_scalar) ||
|
|
John W. Linville |
aeb7fa6 |
+ crypto_bignum_is_one(data->peer_scalar) ||
|
|
John W. Linville |
aeb7fa6 |
+ crypto_bignum_cmp(data->peer_scalar,
|
|
John W. Linville |
aeb7fa6 |
+ crypto_ec_get_order(data->grp->group)) >= 0) {
|
|
John W. Linville |
aeb7fa6 |
+ wpa_printf(MSG_INFO,
|
|
John W. Linville |
aeb7fa6 |
+ "EAP-PWD (server): received scalar is invalid");
|
|
John W. Linville |
aeb7fa6 |
+ goto fin;
|
|
John W. Linville |
aeb7fa6 |
+ }
|
|
John W. Linville |
aeb7fa6 |
+
|
|
John W. Linville |
aeb7fa6 |
+ /* verify received element */
|
|
John W. Linville |
aeb7fa6 |
+ if (!crypto_ec_point_is_on_curve(data->grp->group,
|
|
John W. Linville |
aeb7fa6 |
+ data->peer_element) ||
|
|
John W. Linville |
aeb7fa6 |
+ crypto_ec_point_is_at_infinity(data->grp->group,
|
|
John W. Linville |
aeb7fa6 |
+ data->peer_element)) {
|
|
John W. Linville |
aeb7fa6 |
+ wpa_printf(MSG_INFO,
|
|
John W. Linville |
aeb7fa6 |
+ "EAP-PWD (server): received element is invalid");
|
|
John W. Linville |
aeb7fa6 |
+ goto fin;
|
|
John W. Linville |
aeb7fa6 |
+ }
|
|
John W. Linville |
aeb7fa6 |
+
|
|
John W. Linville |
aeb7fa6 |
/* check to ensure peer's element is not in a small sub-group */
|
|
John W. Linville |
aeb7fa6 |
if (!crypto_bignum_is_one(cofactor)) {
|
|
John W. Linville |
aeb7fa6 |
if (crypto_ec_point_mul(data->grp->group, data->peer_element,
|
|
John W. Linville |
aeb7fa6 |
--
|
|
John W. Linville |
aeb7fa6 |
2.7.4
|
|
John W. Linville |
aeb7fa6 |
|