mirror of
https://github.com/Telecominfraproject/wlan-ap.git
synced 2025-12-20 10:51:27 +00:00
47 lines
2.1 KiB
Diff
47 lines
2.1 KiB
Diff
From 2b8a1fee3488c602aca8bea004a087e60806a5cf Mon Sep 17 00:00:00 2001
|
|
From: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
|
|
Date: Tue, 11 May 2021 20:02:45 +0200
|
|
Subject: cfg80211: mitigate A-MSDU aggregation attacks
|
|
|
|
Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the
|
|
destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP)
|
|
header, and if so dropping the complete A-MSDU frame. This mitigates
|
|
known attacks, although new (unknown) aggregation-based attacks may
|
|
remain possible.
|
|
|
|
This defense works because in A-MSDU aggregation injection attacks, a
|
|
normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means
|
|
the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042
|
|
header. In other words, the destination MAC address of the first A-MSDU
|
|
subframe contains the start of an RFC1042 header during an aggregation
|
|
attack. We can detect this and thereby prevent this specific attack.
|
|
For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi
|
|
Through Frame Aggregation and Fragmentation".
|
|
|
|
Note that for kernel 4.9 and above this patch depends on "mac80211:
|
|
properly handle A-MSDUs that start with a rfc1042 header". Otherwise
|
|
this patch has no impact and attacks will remain possible.
|
|
|
|
Cc: stable@vger.kernel.org
|
|
Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>
|
|
Link: https://lore.kernel.org/r/20210511200110.25d93176ddaf.I9e265b597f2cd23eb44573f35b625947b386a9de@changeid
|
|
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
|
|
---
|
|
net/wireless/util.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/net/wireless/util.c b/net/wireless/util.c
|
|
index 39966a873e40..7ec021a610ae 100644
|
|
--- a/net/wireless/util.c
|
|
+++ b/net/wireless/util.c
|
|
@@ -771,6 +771,9 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
|
|
remaining = skb->len - offset;
|
|
if (subframe_len > remaining)
|
|
goto purge;
|
|
+ /* mitigate A-MSDU aggregation injection attacks */
|
|
+ if (ether_addr_equal(eth.h_dest, rfc1042_header))
|
|
+ goto purge;
|
|
|
|
offset += sizeof(struct ethhdr);
|
|
last = remaining <= subframe_len + padding;
|