wpa_supplicant : PSK configuration parameter update allowing arbitrary data to be...

This commit is patch for mitigation security vulnerability on wpa_supplicant
 - https://w1.fi/security/2016-1/

    Reject SET commands with newline characters in the string values

    Many of the global configuration parameters are written as strings
    without filtering and if there is an embedded newline character in the
    value, unexpected configuration file data might be written.

    This fixes an issue where wpa_supplicant could have updated the
    configuration file global parameter with arbitrary data from the control
    interface or D-Bus interface. While those interfaces are supposed to be
    accessible only for trusted users/applications, it may be possible that
    an untrusted user has access to a management software component that
    does not validate the value of a parameter before passing it to
    wpa_supplicant.

    This could allow such an untrusted user to inject almost arbitrary data
    into the configuration file. Such configuration file could result in
    wpa_supplicant trying to load a library (e.g., opensc_engine_path,
    pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user
    controlled location when starting again. This would allow code from that
    library to be executed under the wpa_supplicant process privileges.

Change-Id: I0f0237ff9809fa8173a08fa45e74447e95a33e7d
Signed-off-by: Jin-Seong Kim <jseong82.kim@samsung.com>

diff --git a/external/wpa_supplicant/wpa_supplicant/config.c b/external/wpa_supplicant/wpa_supplicant/config.c
index 5731825..9a08e6a 100644 (file)
--- a/external/wpa_supplicant/wpa_supplicant/config.c
+++ b/external/wpa_supplicant/wpa_supplicant/config.c
@@ -3476,6 +3476,11 @@ static int wpa_global_config_parse_str(const struct global_parse_data *data, str
                return -1;
        }
 
+       if (has_newline(pos)) {
+               wpa_printf(MSG_ERROR, "Line %d: invalid %s value with newline", line, data->name);
+               return -1;
+       }
+
        tmp = os_strdup(pos);
        if (tmp == NULL) {
                return -1;