[CVE-2016-10743] WPS: Use only os_get_random() for PIN generation

detected by AVAS

https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389

Change-Id: Idccac6d2a407da4e921b03c380e2e7d6906d2e5b

diff --git a/packaging/wifi-efl-ug.spec b/packaging/wifi-efl-ug.spec
index d4bdb349026a5ed1f4503f6ffab764f1ae9b93da..32f39c0edbaaaf888008bdcc58cc2e4cb3a11cdd 100644 (file)
--- a/packaging/wifi-efl-ug.spec
+++ b/packaging/wifi-efl-ug.spec
@@ -1,6 +1,6 @@
 Name:          wifi-efl-ug
 Summary:       Wi-Fi UI Gadget for TIZEN
-Version:       1.0.239
+Version:       1.0.240
 Release:       1
 Group:         App/Network
 License:       Flora-1.1

diff --git a/sources/libraries/Common/common_generate_pin.c b/sources/libraries/Common/common_generate_pin.c
index 4e4b3752642bb8e109eaaf7489c989f162e80008..fcebc268087d5fef5f11f77e9d8e72c5f77171e7 100644 (file)
--- a/sources/libraries/Common/common_generate_pin.c
+++ b/sources/libraries/Common/common_generate_pin.c
@@ -294,21 +294,6 @@ static int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_
        return hmac_sha1_vector(key, key_len, 1, &data, &data_len, mac);
 }
 
-static int os_get_time(struct os_time *t)
-{
-       int res;
-       struct timeval tv;
-       res = gettimeofday(&tv, NULL);
-       t->sec = tv.tv_sec;
-       t->usec = tv.tv_usec;
-       return res;
-}
-
-static unsigned long os_random(void)
-{
-       return random();
-}
-
 static int os_get_random(unsigned char *buf, size_t len)
 {
        FILE *f;
@@ -434,20 +419,19 @@ static unsigned int wps_pin_checksum(unsigned int pin)
  * wps_generate_pin - Generate a random PIN
  * Returns: Eight digit PIN (i.e., including the checksum digit)
  */
-unsigned int wps_generate_pin(void)
+int wps_generate_pin(unsigned int *pin)
 {
        unsigned int val;
 
        /* Generate seven random digits for the PIN */
-       if (random_get_bytes((unsigned char *) &val, sizeof(val)) < 0) {
-               struct os_time now;
-               os_get_time(&now);
-               val = os_random() ^ now.sec ^ now.usec;
-       }
+       if (random_get_bytes((unsigned char *) &val, sizeof(val)) < 0)
+               return -1;
+
        val %= 10000000;
 
        /* Append checksum digit */
-       return val * 10 + wps_pin_checksum(val);
+       *pin = val * 10 + wps_pin_checksum(val);
+       return 0;
 }
 
 

diff --git a/sources/libraries/Common/include/common_generate_pin.h b/sources/libraries/Common/include/common_generate_pin.h
index b7ed66ec98fd140e7046cc28262b20c33687ece3..e30381b2b786fdb7f8e0e2b29a80b691c6f5c349 100644 (file)
--- a/sources/libraries/Common/include/common_generate_pin.h
+++ b/sources/libraries/Common/include/common_generate_pin.h
@@ -36,7 +36,7 @@ struct SHA1Context {
        unsigned char buffer[64];
 };
 
-unsigned int wps_generate_pin(void);
+int wps_generate_pin(unsigned int *pin);
 
 #ifdef __cplusplus
 }

diff --git a/sources/ui-gadget/viewers-layout/wifi_viewer_list.c b/sources/ui-gadget/viewers-layout/wifi_viewer_list.c
index 2142e3be45445dd7eaf1e47209f25434a25592af..1018cc7fa23b5c5d2001c198a0f71cbcd4c5fbe0 100755 (executable)
--- a/sources/ui-gadget/viewers-layout/wifi_viewer_list.c
+++ b/sources/ui-gadget/viewers-layout/wifi_viewer_list.c
@@ -495,7 +495,12 @@ static void _wps_pin_cb(void* data, Evas_Object* obj, void* event_info)
        ug_app_state->is_wifi_scan_indication_block = 1;
 
        /* Generate WPS pin */
-       rpin = wps_generate_pin();
+       if (wps_generate_pin(&rpin) < 0) {
+               ERROR_LOG(UG_NAME_NORMAL, "Failed to generate WPS PIN");
+               __COMMON_FUNC_EXIT__;
+               return;
+       }
+
        if (rpin > 0)
                g_snprintf(npin, sizeof(npin), "%08d", rpin);
 

diff --git a/sources/wifi-syspopup/viewer-popups/view-main.c b/sources/wifi-syspopup/viewer-popups/view-main.c
index e791dade093d6e7d0450154dd861f43b0ef85d98..a0cb19ce75832131a7ac8999358336e1e5335a48 100755 (executable)
--- a/sources/wifi-syspopup/viewer-popups/view-main.c
+++ b/sources/wifi-syspopup/viewer-popups/view-main.c
@@ -221,7 +221,12 @@ static void _wps_pin_cb(void* data, Evas_Object* obj, void* event_info)
                return;
 
        /* Generate WPS pin */
-       rpin = wps_generate_pin();
+       if (wps_generate_pin(&rpin) < 0) {
+               ERROR_LOG(UG_NAME_NORMAL, "Failed to generate WPS PIN");
+               __COMMON_FUNC_EXIT__;
+               return;
+       }
+
        if (rpin > 0)
                g_snprintf(npin, sizeof(npin), "%08d", rpin);