Bug 1699170 (CVE-2019-9499)

Summary:	CVE-2019-9499 wpa_supplicant: EAP-pwd peer missing commit validation for scalar/element
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bgalvani, blueowl, bmcclain, dblechte, dcaratti, dcbw, dfediuck, eedri, john.j5live, linville, lkundrak, mgoldboi, michal.skrivanek, negativo17, sbonazzo, sherold, sukulkar, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in wpa_supplicant. An attack using invalid scalar/element values is possible against the EAP-pwd peer since hostapd and wpa_supplicant did not validate these values in the received EAP-pwd-Commit messages.When processing an EAP-pwd Commit frame, the server's scalar and element (elliptic curve point) were not validated. This allowed an adversary to bypass authentication, and act as a rogue Access Point (AP) if the crypto implementation did not verify the validity of the EC point. The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL (and also BoringSSL) implicitly validate the elliptic curve point in EC_POINT_set_affine_coordinates_GFp(), preventing the attack. The highest threat from this vulnerability is to data confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:54:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1687612

Description Laura Pardo 2019-04-12 00:33:42 UTC

An attack using invalid scalar/element values is possible against the EAP-pwd peer since hostapd and wpa_supplicant did not validate these values in the received EAP-pwd-Commit messages.When processing an EAP-pwd Commit frame, the server's scalar and element (elliptic curve point) were not validated. This allowed an adversary to bypass authentication, and act as a rogue Access Point (AP) if the crypto implementation did not verify the validity of the EC point.

The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL (and also BoringSSL) implicitly validate the elliptic curve point in EC_POINT_set_affine_coordinates_GFp(), preventing the attack.



References:
https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt
https://wpa3.mathyvanhoef.com/


Upstream Patch:
https://w1.fi/cgit/hostap/commit/?id=8ad8585f91823ddcc3728155e288e0f9f872e31a
https://w1.fi/cgit/hostap/commit/?id=16d4f1069118aa19bfce013493e1ac5783f92f1d

Comment 4 Laura Pardo 2019-04-12 20:35:00 UTC

Acknowledgments:

Name: Mathy Vanhoef (NYUAD), Eyal Ronen (Tel Aviv University & KU Leuven)

Comment 5 Laura Pardo 2019-04-12 20:35:03 UTC

External References:

https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt
https://www.kb.cert.org/vuls/id/871675/

Comment 7 Eric Christensen 2020-04-29 15:02:02 UTC

Statement:

This issue did not affect the versions of wpa_supplicant as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for EAP-pwd.

This issue did not affect the versions of wpa_supplicant as shipped with Red Hat Enterprise Linux 7 as they are not compiled with EAP-pwd enabled. In particular, the CONFIG_EAP_PWD=y option is not set at compile time.