From 48e63f16f297d04f0b07cd11ae58563ee17baa43 Mon Sep 17 00:00:00 2001 From: tb Date: Sat, 3 Jun 2017 11:58:10 +0000 Subject: [PATCH] Explicitly zero out the wepseed for TKIP and WEP. ok stsp --- sys/net80211/ieee80211_crypto_tkip.c | 4 +++- sys/net80211/ieee80211_crypto_wep.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/sys/net80211/ieee80211_crypto_tkip.c b/sys/net80211/ieee80211_crypto_tkip.c index ee26433987e..d1b44a4f3f9 100644 --- a/sys/net80211/ieee80211_crypto_tkip.c +++ b/sys/net80211/ieee80211_crypto_tkip.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_crypto_tkip.c,v 1.28 2017/03/23 04:10:10 tb Exp $ */ +/* $OpenBSD: ieee80211_crypto_tkip.c,v 1.29 2017/06/03 11:58:10 tb Exp $ */ /*- * Copyright (c) 2008 Damien Bergamini @@ -234,6 +234,7 @@ ieee80211_tkip_encrypt(struct ieee80211com *ic, struct mbuf *m0, } Phase2((u_int8_t *)wepseed, k->k_key, ctx->txttak, k->k_tsc & 0xffff); rc4_keysetup(&ctx->rc4, (u_int8_t *)wepseed, 16); + explicit_bzero(wepseed, sizeof(wepseed)); /* encrypt frame body and compute WEP ICV */ m = m0; @@ -389,6 +390,7 @@ ieee80211_tkip_decrypt(struct ieee80211com *ic, struct mbuf *m0, } Phase2((u_int8_t *)wepseed, k->k_key, ctx->rxttak, tsc & 0xffff); rc4_keysetup(&ctx->rc4, (u_int8_t *)wepseed, 16); + explicit_bzero(wepseed, sizeof(wepseed)); /* decrypt frame body and compute WEP ICV */ m = m0; diff --git a/sys/net80211/ieee80211_crypto_wep.c b/sys/net80211/ieee80211_crypto_wep.c index 0bc428091c9..6bd1ff7702d 100644 --- a/sys/net80211/ieee80211_crypto_wep.c +++ b/sys/net80211/ieee80211_crypto_wep.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_crypto_wep.c,v 1.15 2017/03/23 04:10:10 tb Exp $ */ +/* $OpenBSD: ieee80211_crypto_wep.c,v 1.16 2017/06/03 11:58:10 tb Exp $ */ /*- * Copyright (c) 2008 Damien Bergamini @@ -125,6 +125,7 @@ ieee80211_wep_encrypt(struct ieee80211com *ic, struct mbuf *m0, memcpy(wepseed, ivp, IEEE80211_WEP_IVLEN); memcpy(wepseed + IEEE80211_WEP_IVLEN, k->k_key, k->k_len); rc4_keysetup(&ctx->rc4, wepseed, IEEE80211_WEP_IVLEN + k->k_len); + explicit_bzero(wepseed, sizeof(wepseed)); /* encrypt frame body and compute WEP ICV */ m = m0; @@ -220,6 +221,7 @@ ieee80211_wep_decrypt(struct ieee80211com *ic, struct mbuf *m0, memcpy(wepseed, ivp, IEEE80211_WEP_IVLEN); memcpy(wepseed + IEEE80211_WEP_IVLEN, k->k_key, k->k_len); rc4_keysetup(&ctx->rc4, wepseed, IEEE80211_WEP_IVLEN + k->k_len); + explicit_bzero(wepseed, sizeof(wepseed)); MGET(n0, M_DONTWAIT, m0->m_type); if (n0 == NULL) -- 2.20.1