wpa_supplicant crashes when authenticating
Bug #364781 reported by
R@ndom
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
wpasupplicant (Ubuntu) |
Incomplete
|
Undecided
|
Unassigned |
Bug Description
Binary package hint: wpasupplicant
1) Ubuntu 9.04
2) package wpa_supplicant 0.6.6-2ubuntu1
3) After upgrade from 8.10 to 9.04 I I was expecting wpa_supplicant to authenticate with TTLS method
4) EAPOL: SUPP_BE entering state RECEIVE
RX EAPOL from .....
RX EAPOL - hexdump(len=1028):
*** stack smashing detected ***: wpa_supplicant terminated
After compiling wpa_supplicant from source 0.6.9 it works perfectly.
To post a comment you must log in.
This issue is not present in the upstream 0.6.6 release, i.e., it is introduced by 08_syslog_ supplement. patch that Ubuntu 9.04 seems to be using. That patch is seriously broken: it introduces a buffer overflow where a stack buffer is written over due to a fixed size buffer used with sprintf and no bounds checking. The debug functions take in variable length data which may depend on data from external systems (i.e., untrusted systems control what gets written to the stack..). Disabling verbose debugging (i.e., not including -dd on the command line) is likely to be enough to work around this. Anyway, the proper fix would be to either revert that broken patch or fix it to handle variable length (and potentially very long) debug messages.
There is also an upstream case for this (http:// w1.fi/bugz/ show_bug. cgi?id= 317), but that will be closed since this was confirmed to be an issue in debian/ubuntu patches, not upstream releases.