[CVE-2016-10743] WPS: Use only os_get_random() for PIN generation

detected by AVAS

https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389

Change-Id: Idccac6d2a407da4e921b03c380e2e7d6906d2e5b

diff --git a/packaging/wifi-efl-ug.spec b/packaging/wifi-efl-ug.spec
index d4bdb34..32f39c0 100644 (file)
--- a/packaging/wifi-efl-ug.spec
+++ b/packaging/wifi-efl-ug.spec
@@ -1,6 +1,6 @@
 Name:          wifi-efl-ug
 Summary:       Wi-Fi UI Gadget for TIZEN
-Version:       1.0.239
+Version:       1.0.240
 Release:       1
 Group:         App/Network
 License:       Flora-1.1

diff --git a/sources/libraries/Common/common_generate_pin.c b/sources/libraries/Common/common_generate_pin.c
index 4e4b375..fcebc26 100644 (file)
--- a/sources/libraries/Common/common_generate_pin.c
+++ b/sources/libraries/Common/common_generate_pin.c
@@ -294,21 +294,6 @@ static int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_
        return hmac_sha1_vector(key, key_len, 1, &data, &data_len, mac);
 }
 
-static int os_get_time(struct os_time *t)
-{
-       int res;
-       struct timeval tv;
-       res = gettimeofday(&tv, NULL);
-       t->sec = tv.tv_sec;
-       t->usec = tv.tv_usec;
-       return res;
-}
-
-static unsigned long os_random(void)
-{
-       return random();
-}
-
 static int os_get_random(unsigned char *buf, size_t len)
 {
        FILE *f;
@@ -434,20 +419,19 @@ static unsigned int wps_pin_checksum(unsigned int pin)
  * wps_generate_pin - Generate a random PIN
  * Returns: Eight digit PIN (i.e., including the checksum digit)
  */
-unsigned int wps_generate_pin(void)
+int wps_generate_pin(unsigned int *pin)
 {
        unsigned int val;
 
        /* Generate seven random digits for the PIN */
-       if (random_get_bytes((unsigned char *) &val, sizeof(val)) < 0) {
-               struct os_time now;
-               os_get_time(&now);
-               val = os_random() ^ now.sec ^ now.usec;
-       }
+       if (random_get_bytes((unsigned char *) &val, sizeof(val)) < 0)
+               return -1;
+
        val %= 10000000;
 
        /* Append checksum digit */
-       return val * 10 + wps_pin_checksum(val);
+       *pin = val * 10 + wps_pin_checksum(val);
+       return 0;
 }
 
 

diff --git a/sources/libraries/Common/include/common_generate_pin.h b/sources/libraries/Common/include/common_generate_pin.h
index b7ed66e..e30381b 100644 (file)
--- a/sources/libraries/Common/include/common_generate_pin.h
+++ b/sources/libraries/Common/include/common_generate_pin.h
@@ -36,7 +36,7 @@ struct SHA1Context {
        unsigned char buffer[64];
 };
 
-unsigned int wps_generate_pin(void);
+int wps_generate_pin(unsigned int *pin);
 
 #ifdef __cplusplus
 }

diff --git a/sources/ui-gadget/viewers-layout/wifi_viewer_list.c b/sources/ui-gadget/viewers-layout/wifi_viewer_list.c
index 2142e3b..1018cc7 100755 (executable)
--- a/sources/ui-gadget/viewers-layout/wifi_viewer_list.c
+++ b/sources/ui-gadget/viewers-layout/wifi_viewer_list.c
@@ -495,7 +495,12 @@ static void _wps_pin_cb(void* data, Evas_Object* obj, void* event_info)
        ug_app_state->is_wifi_scan_indication_block = 1;
 
        /* Generate WPS pin */
-       rpin = wps_generate_pin();
+       if (wps_generate_pin(&rpin) < 0) {
+               ERROR_LOG(UG_NAME_NORMAL, "Failed to generate WPS PIN");
+               __COMMON_FUNC_EXIT__;
+               return;
+       }
+
        if (rpin > 0)
                g_snprintf(npin, sizeof(npin), "%08d", rpin);
 

diff --git a/sources/wifi-syspopup/viewer-popups/view-main.c b/sources/wifi-syspopup/viewer-popups/view-main.c
index e791dad..a0cb19c 100755 (executable)
--- a/sources/wifi-syspopup/viewer-popups/view-main.c
+++ b/sources/wifi-syspopup/viewer-popups/view-main.c
@@ -221,7 +221,12 @@ static void _wps_pin_cb(void* data, Evas_Object* obj, void* event_info)
                return;
 
        /* Generate WPS pin */
-       rpin = wps_generate_pin();
+       if (wps_generate_pin(&rpin) < 0) {
+               ERROR_LOG(UG_NAME_NORMAL, "Failed to generate WPS PIN");
+               __COMMON_FUNC_EXIT__;
+               return;
+       }
+
        if (rpin > 0)
                g_snprintf(npin, sizeof(npin), "%08d", rpin);