A vulnerability was discovered in how wpa_supplicant processing P2P (Wi-Fi Direct) group information from active group owners. The actual parsing of that information validates field lengths appropriately, but processing of the parsed information misses a length check when storing a copy of the secondary device types. This can result in writing attacker controlled data into the peer entry after the area assigned for the secondary device type. The overflow can result in corrupting pointers for heap allocations. This can result in an attacker within radio range of the device running P2P discovery being able to cause unexpected behavior, including termination of the wpa_supplicant process and potentially arbitrary code execution. Reference: https://www.openwall.com/lists/oss-security/2021/02/03/4 Upstream patch: https://w1.fi/cgit/hostap/commit/?id=947272febe24a8f0ea828b5b2f35f13c3821901e
Created wpa_supplicant tracking bugs for this issue: Affects: fedora-all [bug 1925153]
External References: https://w1.fi/security/2020-2/wpa_supplicant-p2p-group-info-processing-vulnerability.txt
The p2p_copy_client_info() function in p2p/p2p.c did not properly check the number of 'sec_dev_type' entries (num_sec_dev_types) leading to a potential buffer overflow when storing a copy of the secondary device types into WPS secondary device type list (wps_sec_dev_type_list). This is prevented in the fixed version by capping the length at WPS_SEC_DEV_TYPE_MAX_LEN, i.e., the maximum size of the buffer.
Mitigation: Disable Wi-Fi P2P support (Wi-Fi Direct) if not needed, by using the control interface command "P2P_SET disabled 1" or setting "p2p_disabled=1" in wpa_supplicant configuration file.
FEDORA-2021-defe51d282 has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1686 https://access.redhat.com/errata/RHSA-2021:1686
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-0326