From owner-freebsd-bugs@freebsd.org Thu Feb 23 16:32:39 2017 Return-Path: Delivered-To: freebsd-bugs@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6AFF1CEAFDD for ; Thu, 23 Feb 2017 16:32:39 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2001:1900:2254:206a::16:76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4FB281722 for ; Thu, 23 Feb 2017 16:32:39 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from bugs.freebsd.org ([127.0.1.118]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id v1NGWdNb049814 for ; Thu, 23 Feb 2017 16:32:39 GMT (envelope-from bugzilla-noreply@freebsd.org) From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 217312] [patch] /sbin/ifconfig core dumps on bad WPS frame data Date: Thu, 23 Feb 2017 16:32:39 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: bin X-Bugzilla-Version: CURRENT X-Bugzilla-Keywords: patch X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: fbsd@opal.com X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: freebsd-bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status keywords bug_severity priority component assigned_to reporter attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Feb 2017 16:32:39 -0000 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D217312 Bug ID: 217312 Summary: [patch] /sbin/ifconfig core dumps on bad WPS frame data Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Keywords: patch Severity: Affects Only Me Priority: --- Component: bin Assignee: freebsd-bugs@FreeBSD.org Reporter: fbsd@opal.com Keywords: patch Created attachment 180244 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D180244&action= =3Dedit patch to detect bad length value in WPE IE attribute Thanks to Takashi Inoue at Nihon U for his efforts in debugging this. Some APs broadcast WPS IE frames with totally broken data. Ifconfig's printwpsie() loops through WPS frames printing the attributes out; if the frame's data is bad, printwpsie() can end up looking at out-of-bounds addre= sses causing ifconfig to bus error. This is an example of a bad WPS IE frame received... ielen=3D41, len=3D39 printwpsie() ie[0]=3D0xdd printwpsie() ie[1]=3D0x27 printwpsie() ie[2]=3D0x0 printwpsie() ie[3]=3D0x50 printwpsie() ie[4]=3D0xf2 printwpsie() ie[5]=3D0x4 printwpsie() ie[6]=3D0x10 <- id[0] printwpsie() ie[7]=3D0x4a <- id[1], id=3D0x104a VERSION printwpsie() ie[8]=3D0x4a <- len[0], broken should be 0 printwpsie() ie[9]=3D0x1 <- len[1] printwpsie() ie[10]=3D0x10 printwpsie() ie[11]=3D0x1 <- id[0] printwpsie() ie[12]=3D0x10 <- id[1], broken 0x0110 is not a valid ID value printwpsie() ie[13]=3D0x0 printwpsie() ie[14]=3D0x1 printwpsie() ie[15]=3D0x2 printwpsie() ie[16]=3D0x10 printwpsie() ie[17]=3D0x47 printwpsie() ie[18]=3D0x0 printwpsie() ie[19]=3D0x10 printwpsie() ie[20]=3D0xe5 printwpsie() ie[21]=3D0x85 printwpsie() ie[22]=3D0xf2 printwpsie() ie[23]=3D0xf8 printwpsie() ie[24]=3D0xf8 printwpsie() ie[25]=3D0x9a printwpsie() ie[26]=3D0x11 printwpsie() ie[27]=3D0x9a printwpsie() ie[28]=3D0x11 printwpsie() ie[29]=3D0x3b printwpsie() ie[30]=3D0x4b printwpsie() ie[31]=3D0x3b printwpsie() ie[32]=3D0x4b printwpsie() ie[33]=3D0x10 printwpsie() ie[34]=3D0xc3 printwpsie() ie[35]=3D0x10 printwpsie() ie[36]=3D0xc3 printwpsie() ie[37]=3D0x3c printwpsie() ie[38]=3D0x0 printwpsie() ie[39]=3D0x3c printwpsie() ie[40]=3D0x3c We do not currently have the manufacturer/model number of the offending dev= ice. We are attempting to get it and will post back here if/when we do. The attached patch to src/sbin/ifconfig/ifieee80211.c detects an invalid attribute length and aborts the loop, thereby handling the bad frame proper= ly. This also affects 11.0 and probably 10.0 too, please MFC. --=20 You are receiving this mail because: You are the assignee for the bug.=