DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

DPP3: Fix potential use-after-free on push button bootstrap info

Browse source 
When removing the bootstrap info for the PB context, all the possible
pointers to that information needs to be cleared to avoid accesses to
freed memory.

Fixes: 37bccfcab8 ("DPP3: Push button bootstrap mechanism")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This commit is contained in:
Jouni Malinen 2024-01-22 12:41:02 +02:00 committed by Jouni Malinen
parent e3d6fce848
commit 9456adeeba
3 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
hostapd/ctrl_iface.c
View file

@ -4542,6 +4542,7 @@ static void hostapd_ctrl_iface_flush(struct hapd_interfaces *interfaces)
#ifdef CONFIG_DPP #ifdef CONFIG_DPP
dpp_global_clear(interfaces->dpp); dpp_global_clear(interfaces->dpp);
#ifdef CONFIG_DPP3 #ifdef CONFIG_DPP3
interfaces->dpp_pb_bi = NULL;
{ {
int i; int i;

14
src/ap/dpp_hostapd.c
View file

@ -3955,11 +3955,25 @@ void hostapd_dpp_push_button_stop(struct hostapd_data *hapd)
ifaces->dpp_pb_time.usec = 0; ifaces->dpp_pb_time.usec = 0;
dpp_pkex_free(hapd->dpp_pkex); dpp_pkex_free(hapd->dpp_pkex);
hapd->dpp_pkex = NULL; hapd->dpp_pkex = NULL;
hapd->dpp_pkex_bi = NULL;
os_free(hapd->dpp_pkex_auth_cmd); os_free(hapd->dpp_pkex_auth_cmd);
hapd->dpp_pkex_auth_cmd = NULL; hapd->dpp_pkex_auth_cmd = NULL;
if (ifaces->dpp_pb_bi) { if (ifaces->dpp_pb_bi) {
char id[20]; char id[20];
size_t i;
for (i = 0; i < ifaces->count; i++) {
struct hostapd_iface *iface = ifaces->iface[i];
size_t j;
for (j = 0; iface && j < iface->num_bss; j++) {
struct hostapd_data *h = iface->bss[j];
if (h->dpp_pkex_bi == ifaces->dpp_pb_bi)
h->dpp_pkex_bi = NULL;
}
}
os_snprintf(id, sizeof(id), "%u", ifaces->dpp_pb_bi->id); os_snprintf(id, sizeof(id), "%u", ifaces->dpp_pb_bi->id);
dpp_bootstrap_remove(ifaces->dpp, id); dpp_bootstrap_remove(ifaces->dpp, id);

2
wpa_supplicant/dpp_supplicant.c
View file

@ -5665,6 +5665,8 @@ void wpas_dpp_push_button_stop(struct wpa_supplicant *wpa_s)
if (wpa_s->dpp_pb_bi) { if (wpa_s->dpp_pb_bi) {
char id[20]; char id[20];
if (wpa_s->dpp_pb_bi == wpa_s->dpp_pkex_bi)
wpa_s->dpp_pkex_bi = NULL;
os_snprintf(id, sizeof(id), "%u", wpa_s->dpp_pb_bi->id); os_snprintf(id, sizeof(id), "%u", wpa_s->dpp_pb_bi->id);
dpp_bootstrap_remove(wpa_s->dpp, id); dpp_bootstrap_remove(wpa_s->dpp, id);
wpa_s->dpp_pb_bi = NULL; wpa_s->dpp_pb_bi = NULL;