lkml.org 
[lkml]   [2021]   [May]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 017/177] cfg80211: mitigate A-MSDU aggregation attacks
    Date
    From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>

    commit 2b8a1fee3488c602aca8bea004a087e60806a5cf upstream.

    Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the
    destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP)
    header, and if so dropping the complete A-MSDU frame. This mitigates
    known attacks, although new (unknown) aggregation-based attacks may
    remain possible.

    This defense works because in A-MSDU aggregation injection attacks, a
    normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
    the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
    header. In other words, the destination MAC address of the first A-MSDU
    subframe contains the start of an RFC1042 header during an aggregation
    attack. We can detect this and thereby prevent this specific attack.
    For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi
    Through Frame Aggregation and Fragmentation".

    Note that for kernel 4.9 and above this patch depends on "mac80211:
    properly handle A-MSDUs that start with a rfc1042 header". Otherwise
    this patch has no impact and attacks will remain possible.

    Cc: stable@vger.kernel.org
    Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
    Link: https://lore.kernel.org/r/20210511200110.25d93176ddaf.I9e265b597f2cd23eb44573f35b625947b386a9de@changeid
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/wireless/util.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/net/wireless/util.c
    +++ b/net/wireless/util.c
    @@ -681,6 +681,9 @@ void ieee80211_amsdu_to_8023s(struct sk_
    remaining = skb->len - offset;
    if (subframe_len > remaining)
    goto purge;
    + /* mitigate A-MSDU aggregation injection attacks */
    + if (ether_addr_equal(eth.h_dest, rfc1042_header))
    + goto purge;

    offset += sizeof(struct ethhdr);
    last = remaining <= subframe_len + padding;

    \
     
     \ /
      Last update: 2021-05-31 17:30    [W:2.192 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site