Stefan Lippers-Hollmann 7b6ee74ee9 hostapd: P2P: Fix a corner case in peer addition based on PD Request ... p2p_add_device() may remove the oldest entry if there is no room in the peer table for a new peer. This would result in any pointer to that removed entry becoming stale. A corner case with an invalid PD Request frame could result in such a case ending up using (read+write) freed memory. This could only by triggered when the peer table has reached its maximum size and the PD Request frame is received from the P2P Device Address of the oldest remaining entry and the frame has incorrect P2P Device Address in the payload. Fix this by fetching the dev pointer again after having called p2p_add_device() so that the stale pointer cannot be used. This fixes the following security vulnerabilities/bugs: - CVE-2021-27803 - A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range. Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request") Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> (cherry picked from commit 1ca5de13a1)		2021-03-01 21:49:55 +01:00
..
config	ltq-adsl-app: use ubus to provide metrics	2021-02-08 21:43:00 +01:00
ipv6	odhcp6c: fix routing loop on point-to-point links	2021-01-17 21:22:39 +01:00
services	hostapd: P2P: Fix a corner case in peer addition based on PD Request	2021-03-01 21:49:55 +01:00
utils	build: reorder more BuildPackages lines to deal with ABI_VERSION	2021-02-16 12:27:56 +01:00