Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica) [LWN.net]

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted Apr 23, 2015 15:43 UTC (Thu) by BenHutchings (subscriber, #37955)
Parent article: Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

The wpa_supplicant bug is apparently only in P2P support, so it can be mitigated by disabling that at compile-time or run-time. It seems to be disabled on some Android systems already for other reasons - my phone running CyanogenMod 11 has "p2p_disabled=1" in /etc/wifi/wpa_supplicant_overlay.conf.

to post comments

P2P most serious, but DoS possible with P2P disabled

Posted Apr 23, 2015 23:11 UTC (Thu) by Duncan (guest, #6647) [Link] (3 responses)

Based on the article, there's either two related bugs, or two triggers for the same bug, depending on how you look at it.

The more serious bug/trigger is apparently in P2P support. It will allow information leakage and potentially allow code execution as well. This one is apparently avoided if P2P support is disabled.

But there's a less serious DOS possibility as well; a crafted SSID could crash WIFI. This one apparently doesn't require P2P and is thus possible regardless of whether it is enabled.

Comments at Ars suggest that unicode SSIDs are an easy way to exceed the buffer, and Alibaba as the source of the discovery would seem to support that. Additionally, a number of Ars users had previously found certain unicode (one commenter) and emoji (another, samsung smart tvs go into an infinite crash/reboot cycle) containing SSIDs did break wifi on some of their equipment, so they simply quit using those types of SSIDs. With this story they believe they now understand the cause.

But I simply RTFA (and comments) and don't claim to be a dev let alone a kernel hacker, so you may well know details I don't?

Regardless, safest to assume at least a DOS is possible without P2P enabled, until we know for certain otherwise.

Duncan

P2P most serious, but DoS possible with P2P disabled

Posted Apr 24, 2015 10:05 UTC (Fri) by ledow (guest, #11753) [Link]

It does seem yet another one of those quite-simple things that should have been caught much earlier.

Is this in any way related to the similar Apple bug where you can send an iPad into a reboot-loop for all the time that it's near a rogue Wifi point?

P2P most serious, but DoS possible with P2P disabled

Posted Apr 24, 2015 10:56 UTC (Fri) by johill (subscriber, #25196) [Link]

It's not a kernel bug :)

It's really just one bug. And the problem cannot happen with just a "crafted SSID". For it to happen outside of an actual P2P usage scenario, you still have to have a scan result with a P2P device address or device ID attribute.

P2P most serious, but DoS possible with P2P disabled

Posted Apr 24, 2015 10:59 UTC (Fri) by johill (subscriber, #25196) [Link]

Sorry for the dupe post - wrong button.

Also, with p2p disabled it's not possible to trigger this bug in any way as this code path would never be executed. With P2P compiled out the code doesn't even exist in the binary.