Ubuntu
wpasupplicant package

wpa_supplicant crashes when authenticating

Bug #364781 reported by R@ndom on 2009-04-21

Affects		Status	Importance	Assigned to	Milestone
	wpasupplicant (Ubuntu)	Incomplete	Undecided	Unassigned

Bug Description

Binary package hint: wpasupplicant

1) Ubuntu 9.04
2) package wpa_supplicant 0.6.6-2ubuntu1
3) After upgrade from 8.10 to 9.04 I I was expecting wpa_supplicant to authenticate with TTLS method
4) EAPOL: SUPP_BE entering state RECEIVE
RX EAPOL from .....
RX EAPOL - hexdump(len=1028):
*** stack smashing detected ***: wpa_supplicant terminated

After compiling wpa_supplicant from source 0.6.9 it works perfectly.

Revision history for this message

R@ndom (radek-strnad) wrote on 2009-04-21:

command line output - mac addresses, username & passwords were changed Edit (13.3 KiB, text/plain)

Revision history for this message

Jouni Malinen (jkmaline) wrote on 2009-06-17:

This issue is not present in the upstream 0.6.6 release, i.e., it is introduced by 08_syslog_supplement.patch that Ubuntu 9.04 seems to be using. That patch is seriously broken: it introduces a buffer overflow where a stack buffer is written over due to a fixed size buffer used with sprintf and no bounds checking. The debug functions take in variable length data which may depend on data from external systems (i.e., untrusted systems control what gets written to the stack..). Disabling verbose debugging (i.e., not including -dd on the command line) is likely to be enough to work around this. Anyway, the proper fix would be to either revert that broken patch or fix it to handle variable length (and potentially very long) debug messages.

There is also an upstream case for this (http://w1.fi/bugz/show_bug.cgi?id=317), but that will be closed since this was confirmed to be an issue in debian/ubuntu patches, not upstream releases.

Revision history for this message

Jouni Malinen (jkmaline) wrote on 2009-06-18:

Looks like the same issue had also been reported for debian and fixed there by dropping the broken patch: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=528639

Revision history for this message

Maarten Bezemer (veger) wrote on 2012-05-17:

Thank you for taking the time to report this bug and helping to make Ubuntu better. We are sorry that we do not always have the capacity to look at all reported bugs in a timely manner. There have been many changes in Ubuntu since that time you reported the bug and your problem may have been fixed with some of the updates. It would help us a lot if you could test it on a currently supported Ubuntu version. When you test it and it is still an issue, kindly upload the updated logs by running apport-collect 364781 and any other logs that are relevant for this particular issue.