HomeFreeBSD

net80211: prevent plaintext injection by A-MSDU RFC1042/EAPOL frames

Description

net80211: prevent plaintext injection by A-MSDU RFC1042/EAPOL frames

No longer accept plaintext A-MSDU frames that start with an RFC1042
header with EtherType EAPOL. This is done by only accepting EAPOL
packets that are included in non-aggregated 802.11 frames.

Note that before this patch, FreeBSD also only accepted EAPOL frames
that are sent in a non-aggregated 802.11 frame due to bugs in
processing EAPOL packets inside A-MSDUs. In other words,
compatibility with legitimate devices remains the same.

This relates to section 6.5 in the 2021 Usenix "FragAttacks" (Fragment
and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation)
paper.

Submitted by: Mathy Vanhoef (Mathy.Vanhoef kuleuven.be)
Security: CVE-2020-26144
PR: 256120
MFC after: 7 days
Differential Revision: https://reviews.freebsd.org/D30665

Details

Provenance
Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be>Authored on Jun 6 2021, 10:10 PM
bzCommitted on Sep 30 2021, 2:54 PM
Differential Revision
D30665: net80211: prevent plaintext injection by A-MSDU RFC1042/EAPOL frames
Parents
R10:f024bdf1155f: net80211: mitigation against A-MSDU design flaw
Branches
Unknown
Tags
Unknown