Bug 1699164 (CVE-2019-9497)

Summary:	CVE-2019-9497 wpa_supplicant: EAP-pwd server not checking for reflection attack
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bmcclain, dblechte, dcaratti, dfediuck, eedri, linville, mgoldboi, michal.skrivanek, negativo17, sbonazzo, sherold, sukulkar, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:53:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1699165, 1699166
Bug Blocks:	1687612

Description Laura Pardo 2019-04-12 00:04:09 UTC

A reflection attack is possible against the EAP-pwd server since the hostapd EAP server did not verify that the EAP-pwd-Commit contains scalar/element values that differ from the ones the server sent out itself. This allows the attacker to complete EAP-pwd authentication without knowing the password, but this does not result in the attacker being able to derive the session key (MSK), i.e., the attacker would not be able to complete the following key exchange (e.g., 4-way handshake in RSN/WPA).


References:
https://wpa3.mathyvanhoef.com/
https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt

Upstream Patch:
https://w1.fi/cgit/hostap/commit/?id=d63edfa90243e9a7de6ae5c275032f2cc79fef95

Comment 1 Laura Pardo 2019-04-12 00:04:30 UTC

Created hostapd tracking bugs for this issue:

Affects: epel-all [bug 1699166]
Affects: fedora-all [bug 1699165]

Comment 3 Riccardo Schirone 2019-04-12 14:46:09 UTC

Statement:

This issue did not affect the versions of wpa_supplicant as shipped with Red Hat Enterprise Linux 5, 6 as they did not include support for EAP-pwd.

This issue did not affect the versions of wpa_supplicant as shipped with Red Hat Enterprise Linux 7 as they are not compiled with EAP-pwd enabled. In particular, the CONFIG_EAP_PWD=y option is not set at compile time.

Comment 5 Laura Pardo 2019-04-12 20:32:11 UTC

Acknowledgments:

Name: Mathy Vanhoef (NYUAD), Eyal Ronen (Tel Aviv University & KU Leuven)

Comment 7 Riccardo Schirone 2019-04-15 08:11:41 UTC

External References:

https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt
https://www.kb.cert.org/vuls/id/871675/

Comment 9 Fedora Update System 2019-04-23 18:49:19 UTC

hostapd-2.7-2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2019-04-23 20:14:00 UTC

hostapd-2.7-2.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.