git.librecmc.org Git - librecmc/librecmc.git/blob

   1 From 8ad8585f91823ddcc3728155e288e0f9f872e31a Mon Sep 17 00:00:00 2001
   2 From: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
   3 Date: Sun, 31 Mar 2019 17:43:44 +0200
   4 Subject: [PATCH 13/14] EAP-pwd client: Verify received scalar and element
   5
   6 When processing an EAP-pwd Commit frame, the server's scalar and element
   7 (elliptic curve point) were not validated. This allowed an adversary to
   8 bypass authentication, and act as a rogue Access Point (AP) if the
   9 crypto implementation did not verify the validity of the EC point.
  10
  11 Fix this vulnerability by assuring the received scalar lies within the
  12 valid range, and by checking that the received element is not the point
  13 at infinity and lies on the elliptic curve being used. (CVE-2019-9499)
  14
  15 The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower
  16 is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL
  17 (and also BoringSSL) implicitly validate the elliptic curve point in
  18 EC_POINT_set_affine_coordinates_GFp(), preventing the attack.
  19
  20 Signed-off-by: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
  21 ---
  22  src/eap_peer/eap_pwd.c | 20 ++++++++++++++++++++
  23  1 file changed, 20 insertions(+)
  24
  25 --- a/src/eap_peer/eap_pwd.c
  26 +++ b/src/eap_peer/eap_pwd.c
  27 @@ -594,6 +594,26 @@ eap_pwd_perform_commit_exchange(struct e
  28                 goto fin;
  29         }
  30
  31 +       /* verify received scalar */
  32 +       if (crypto_bignum_is_zero(data->server_scalar) ||
  33 +           crypto_bignum_is_one(data->server_scalar) ||
  34 +           crypto_bignum_cmp(data->server_scalar,
  35 +                             crypto_ec_get_order(data->grp->group)) >= 0) {
  36 +               wpa_printf(MSG_INFO,
  37 +                          "EAP-PWD (peer): received scalar is invalid");
  38 +               goto fin;
  39 +       }
  40 +
  41 +       /* verify received element */
  42 +       if (!crypto_ec_point_is_on_curve(data->grp->group,
  43 +                                        data->server_element) ||
  44 +           crypto_ec_point_is_at_infinity(data->grp->group,
  45 +                                          data->server_element)) {
  46 +               wpa_printf(MSG_INFO,
  47 +                          "EAP-PWD (peer): received element is invalid");
  48 +               goto fin;
  49 +       }
  50 +
  51         /* check to ensure server's element is not in a small sub-group */
  52         if (!crypto_bignum_is_one(cofactor)) {
  53                 if (crypto_ec_point_mul(data->grp->group, data->server_element,