Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-16 18:26:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

mac80211: Fix TKIP replay protection immediately after key setup

Browse Source 
[ Upstream commit 6f601265215a421f425ba3a4850a35861d024643 ]

TKIP replay protection was skipped for the very first frame received
after a new key is configured. While this is potentially needed to avoid
dropping a frame in some cases, this does leave a window for replay
attacks with group-addressed frames at the station side. Any earlier
frame sent by the AP using the same key would be accepted as a valid
frame and the internal RSC would then be updated to the TSC from that
frame. This would allow multiple previously transmitted group-addressed
frames to be replayed until the next valid new group-addressed frame
from the AP is received by the station.

Fix this by limiting the no-replay-protection exception to apply only
for the case where TSC=0, i.e., when this is for the very first frame
protected using the new key, and the local RSC had not been set to a
higher value when configuring the key (which may happen with GTK).

Signed-off-by: Jouni Malinen <j@w1.fi>
Link: https://lore.kernel.org/r/20200107153545.10934-1-j@w1.fi
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Jouni Malinen 2020-01-07 17:35:45 +02:00 committed by Greg Kroah-Hartman
parent 2dbb6faebb
commit 0a4b3ef53f
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
net/mac80211/tkip.c
View File

@ -266,9 +266,21 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
if ((keyid >> 6) != key->conf.keyidx) if ((keyid >> 6) != key->conf.keyidx)
return TKIP_DECRYPT_INVALID_KEYIDX; return TKIP_DECRYPT_INVALID_KEYIDX;
if (rx_ctx->ctx.state != TKIP_STATE_NOT_INIT && /* Reject replays if the received TSC is smaller than or equal to the
(iv32 < rx_ctx->iv32 || * last received value in a valid message, but with an exception for
(iv32 == rx_ctx->iv32 && iv16 <= rx_ctx->iv16))) * the case where a new key has been set and no valid frame using that
* key has yet received and the local RSC was initialized to 0. This
* exception allows the very first frame sent by the transmitter to be
* accepted even if that transmitter were to use TSC 0 (IEEE 802.11
* described TSC to be initialized to 1 whenever a new key is taken into
* use).
*/
if (iv32 < rx_ctx->iv32 ||
(iv32 == rx_ctx->iv32 &&
(iv16 < rx_ctx->iv16 ||
(iv16 == rx_ctx->iv16 &&
(rx_ctx->iv32 || rx_ctx->iv16 ||
rx_ctx->ctx.state != TKIP_STATE_NOT_INIT)))))
return TKIP_DECRYPT_REPLAY; return TKIP_DECRYPT_REPLAY;
if (only_iv) { if (only_iv) {