News
Vigil@nce - OpenBSD: unreachable memory reading via Wi-Fi RSN
January 2016 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can force a read at an invalid address in Wi-Fi RSN,
in order to trigger a denial of service of OpenBSD configured as a
Wi-Fi client or access point.
Impacted products: OpenBSD.
Severity: 2/4.
Creation date: 10/11/2015.
DESCRIPTION OF THE VULNERABILITY
The 802.11i extension of the WiFi protocol defines WPA2 or RSN
(Robust Security Network).
The ieee80211_parse_rsn_body() function of the
sys/net80211/ieee80211_input.c file of OpenBSD decodes received
RSN packets. However, if a RSN message contains an unexpected
"groupcipher" value, OpenBSD tries to read an unreachable memory
area when building the reply, which triggers a fatal error.
An attacker can therefore force a read at an invalid address in
Wi-Fi RSN, in order to trigger a denial of service of OpenBSD
configured as a Wi-Fi client or access point.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/OpenBSD-unreachable-memory-reading-via-Wi-Fi-RSN-18270
