kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/mac80211
History
Johannes Berg f9feacb8bb mac80211: reject ToDS broadcast data frames 
commit 3018e947d7 upstream.

AP/AP_VLAN modes don't accept any real 802.11 multicast data
frames, but since they do need to accept broadcast management
frames the same is currently permitted for data frames. This
opens a security problem because such frames would be decrypted
with the GTK, and could even contain unicast L3 frames.

Since the spec says that ToDS frames must always have the BSSID
as the RA (addr1), reject any other data frames.

The problem was originally reported in "Predicting, Decrypting,
and Abusing WPA2/802.11 Group Keys" at usenix
https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/vanhoef
and brought to my attention by Jouni.

Reported-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
--
Dave, I didn't want to send you a new pull request for a single
commit yet again - can you apply this one patch as is?
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: Put the new code in an else-block since the
 previous if-blocks may or may not return]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-07-18 18:40:37 +01:00
..
aes_ccm.c mac80211: Fix regression that triggers a kernel BUG with CCMP 2014-12-01 10:02:12 +00:00
aes_ccm.h mac80211: port CCMP to cryptoapi's CCM driver 2013-10-11 15:38:20 +02:00
aes_cmac.c mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
aes_cmac.h mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
agg-rx.c mac80211: fix use of uninitialised values in RX aggregation 2016-03-24 10:01:07 +00:00
agg-tx.c mac80211: send {ADD,DEL}BA on AC_VO like other mgmt frames, as per spec 2014-02-04 21:48:28 +01:00
cfg.c mac80211: fix purging multicast PS buffer queue 2016-11-20 01:17:05 +00:00
cfg.h mac80211: make cfg80211 ops and privid const 2014-02-04 21:48:21 +01:00
chan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next 2014-05-22 13:58:36 -04:00
debug.h mac80211: process the CSA frame for mesh accordingly 2013-10-28 15:05:28 +01:00
debugfs.c mac80211: use RCU_INIT_POINTER 2014-04-09 10:55:30 +02:00
debugfs.h mac80211: fix some missing includes 2014-04-09 14:49:43 +02:00
debugfs_key.c mac80211: move sdata debugfs dir to vif 2013-03-18 20:10:04 +01:00
debugfs_key.h mac80211: support separate default keys 2010-12-13 15:23:29 -05:00
debugfs_netdev.c mac80211: clear subdir_stations when removing debugfs 2015-08-11 09:57:34 +01:00
debugfs_netdev.h mac80211: fix some missing includes 2014-04-09 14:49:43 +02:00
debugfs_sta.c mac80211: fix agg_status debugfs file write 2014-02-04 21:48:19 +01:00
debugfs_sta.h mac80211: RCU-ify STA info structure access 2008-03-06 15:30:46 -05:00
driver-ops.h mac80211: add a single-transaction driver op to switch contexts 2014-05-26 11:04:41 +02:00
event.c cfg80211: use proper allocation flags 2009-07-10 15:01:49 -04:00
ht.c mac80211: Allow HT capa override to add 40 MHz intolerant 2014-04-22 17:23:19 +02:00
ibss.c mac80211: Requeue work after scan complete for all VIF types. 2016-02-25 00:18:36 +00:00
ieee80211_i.h mac80211: don't use napi_gro_receive() outside NAPI context 2015-06-03 13:27:20 +01:00
iface.c mac80211: ensure we don't update tx power on a non-running sdata 2016-01-05 11:22:19 +00:00
Kconfig mac80211: process the CSA frame for mesh accordingly 2013-10-28 15:05:28 +01:00
key.c mac80211: free management frame keys when removing station 2015-01-15 10:44:09 +00:00
key.h mac80211: free all AP/VLAN keys at once 2013-12-16 11:29:48 +01:00
led.c mac80211: use oneshot blink API for LED triggers 2013-08-01 10:48:49 +02:00
led.h mac80211: use oneshot blink API for LED triggers 2013-08-01 10:48:49 +02:00
main.c mac80211: prevent possible crypto tx tailroom corruption 2015-07-15 10:01:22 +01:00
Makefile mac80211: move TDLS code to another file 2014-05-05 15:56:15 +02:00
mesh.c mac80211: Fix adding of mesh vendor IEs 2017-03-16 02:27:09 +00:00
mesh.h mac80211: Requeue work after scan complete for all VIF types. 2016-02-25 00:18:36 +00:00
mesh_hwmp.c mac80211: mesh: always use the latest target_sn 2014-04-22 17:24:50 +02:00
mesh_pathtbl.c mac80211: mesh: fix call_rcu() usage 2016-01-05 11:22:19 +00:00
mesh_plink.c mac80211: enable WME for peer mesh STA 2014-01-06 17:43:06 +01:00
mesh_ps.c mac80211: clear sequence/fragment number in QoS-null frames 2014-03-05 15:49:54 +01:00
mesh_sync.c mac80211: remove BUG_ON usage 2014-04-29 17:59:27 +02:00
michael.c mac80211: remove ieee80211_get_hdr_info 2008-07-08 14:16:01 -04:00
michael.h mac80211: fix some missing includes 2014-04-09 14:49:43 +02:00
mlme.c cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts 2017-03-16 02:26:32 +00:00
offchannel.c mac80211: fix on-channel remain-on-channel 2014-05-14 15:48:38 +02:00
pm.c mac80211: flush delayed work when entering suspend 2017-06-05 21:17:17 +01:00
rate.c mac80211: fix typo in starting baserate for rts_cts_rate_idx 2014-11-13 11:48:30 +00:00
rate.h mac80211: make rate control ops const 2014-02-04 21:48:21 +01:00
rc80211_minstrel.c mac80211: export the expected throughput 2014-05-21 09:15:16 +02:00
rc80211_minstrel.h mac80211: make rate control ops const 2014-02-04 21:48:21 +01:00
rc80211_minstrel_debugfs.c mac80211: cosmetics for minstrel_debugfs 2013-04-17 17:08:23 +02:00
rc80211_minstrel_ht.c mac80211: minstrel_ht: set default tx aggregation timeout to 0 2016-03-24 10:01:08 +00:00
rc80211_minstrel_ht.h mac80211/minstrel_ht: use the new rate control API 2013-04-22 16:16:41 +02:00
rc80211_minstrel_ht_debugfs.c mac80211: minstrel_ht: replace some occurences of MCS_GROUP_RATES 2013-11-25 20:52:07 +01:00
rc80211_pid.h Fix common misspellings 2011-03-31 11:26:23 -03:00
rc80211_pid_algo.c mac80211: make rate control ops const 2014-02-04 21:48:21 +01:00
rc80211_pid_debugfs.c mac80211: fix some snprintf misuses 2013-10-01 12:16:51 +02:00
rx.c mac80211: reject ToDS broadcast data frames 2017-07-18 18:40:37 +01:00
scan.c mac80211: Requeue work after scan complete for all VIF types. 2016-02-25 00:18:36 +00:00
spectmgmt.c mac80211: use secondary channel offset IE also beacons during CSA 2014-11-20 12:01:51 +00:00
sta_info.c mac80211: fix memory leak 2016-05-01 00:05:50 +02:00
sta_info.h mac80211: fix RX A-MPDU session reorder timer deletion 2015-04-13 16:48:59 +01:00
status.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next 2014-05-29 12:55:38 -04:00
tdls.c cfg80211: constify MAC addresses in cfg80211 ops 2014-05-19 17:34:42 +02:00
tkip.c mac80211: fix checkpatch errors 2013-12-18 10:33:06 +01:00
tkip.h mac80211: fix TKIP races, make API easier to use 2011-07-08 11:11:19 -04:00
trace.c mac80211: trace debug messages 2012-06-24 11:33:18 +02:00
trace.h mac80211: allow null chandef in tracing 2015-12-13 17:49:04 +00:00
tx.c mac80211: fix purging multicast PS buffer queue 2016-11-20 01:17:05 +00:00
util.c mac80211: fix divide by zero when NOA update 2015-12-13 17:49:04 +00:00
vht.c mac80211: allow VHT with peers not capable of 40MHz 2014-05-09 09:56:53 +02:00
wep.c mac80211: move WEP tailroom size check 2015-06-02 12:08:12 +01:00
wep.h mac80211: move RX WEP weak IV counting 2012-03-13 14:54:16 -04:00
wme.c mac80211: send control port protocol frames to the VO queue 2014-02-12 11:26:43 +01:00
wme.h mac80211: save wmm_acm per sdata 2012-06-20 17:35:22 +02:00
wpa.c mac80211: add option to generate CCMP IVs only for mgmt frames 2014-04-25 17:26:15 +02:00
wpa.h mac80211: add generic cipher scheme support 2013-11-25 20:50:52 +01:00