From 9f9ab6fffc3b87d7640d58f849fe1121e9f00fa0 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 13 Apr 2021 18:44:35 +0200 Subject: [PATCH 1/2] wpa_supplicant: add patch for CVE-2021-30004 In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. Fixes: CVE-2021-30004 --- pkgs/os-specific/linux/wpa_supplicant/default.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix index f9198cc8ff4..80eaf04a114 100644 --- a/pkgs/os-specific/linux/wpa_supplicant/default.nix +++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix @@ -37,6 +37,12 @@ stdenv.mkDerivation rec { url = "https://w1.fi/security/2021-1/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch"; sha256 = "04cnds7hmbqc44jasabjvrdnh66i5hwvk2h2m5z94pmgbzncyh3z"; }) + # In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. + (fetchpatch { + name = "CVE-2021-30004.patch"; + url = "https://w1.fi/cgit/hostap/patch/?id=a0541334a6394f8237a4393b7372693cd7e96f15"; + sha256 = "1gbhlz41x1ar1hppnb76pqxj6vimiypy7c4kq6h658637s4am3xg"; + }) ]; # TODO: Patch epoll so that the dbus actually responds From 4480a056c93c1197eb4ff8f93d763b041098c4e5 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 13 Apr 2021 19:32:22 +0200 Subject: [PATCH 2/2] hostapd: add patch for CVE-2021-30004 In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. Fixes: CVE-2021-30004 --- pkgs/os-specific/linux/hostapd/default.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix index 2b018c0267a..5d4edc4f7e7 100644 --- a/pkgs/os-specific/linux/hostapd/default.nix +++ b/pkgs/os-specific/linux/hostapd/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, pkg-config, libnl, openssl, sqlite ? null }: +{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libnl, openssl, sqlite ? null }: stdenv.mkDerivation rec { pname = "hostapd"; @@ -43,6 +43,12 @@ stdenv.mkDerivation rec { url = "https://w1.fi/security/2020-1/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch"; sha256 = "12npqp2skgrj934wwkqicgqksma0fxz09di29n1b5fm5i4njl8d8"; }) + # In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. + (fetchpatch { + name = "CVE-2021-30004.patch"; + url = "https://w1.fi/cgit/hostap/patch/?id=a0541334a6394f8237a4393b7372693cd7e96f15"; + sha256 = "1gbhlz41x1ar1hppnb76pqxj6vimiypy7c4kq6h658637s4am3xg"; + }) ]; outputs = [ "out" "man" ];