Control: tags 1147510 + patch Control: tags 1147510 + pending Control: tags 1148985 + patch Control: tags 1148985 + pending
Dear maintainer, I've prepared an NMU for wpa (versioned as 2:2.10-25.1) but I have not yet uploaded it to any delayed queue, will follow up later on this (and doing the same changes for trixie). Here is already the proposed debdiff. Regards, Salvatore
diff -Nru wpa-2.10/debian/changelog wpa-2.10/debian/changelog --- wpa-2.10/debian/changelog 2025-11-08 10:09:39.000000000 +0100 +++ wpa-2.10/debian/changelog 2026-09-26 14:32:45.000000000 +0200 @@ -1,3 +1,25 @@ +wpa (2:2.10-25.1) unstable; urgency=medium + + * Non-maintainer upload. + * Require network_ctx and AKMP match for accepting PMKSA entry + (CVE-2026-78807) (Closes: #1147510) + * Honor permissions from the wpa_supplicant configuration target file + (Closes: #1148985) + * Use umask to limit access to temporary wpa_supplicant configuration file + (Closes: #1148985) + * Remove alternative wpa_config_write() path on failed memory allocation + (Closes: #1148985) + * Remove the temporary wpa_supplicant config file in error case + (Closes: #1148985) + * Use a random suffix in the temporary wpa_supplicant configuration file + (Closes: #1148985) + * Ensure the temporary config file gets created and is not a symlink + (Closes: #1148985) + * Verify that fclose() succeeds on temporary configuration file + (Closes: #1148985) + + -- Salvatore Bonaccorso <[email protected]> Sat, 26 Sep 2026 14:32:45 +0200 + wpa (2:2.10-25) unstable; urgency=medium [ Mitchell Augustin ] diff -Nru wpa-2.10/debian/patches/Ensure-the-temporary-config-file-gets-created-and-is.patch wpa-2.10/debian/patches/Ensure-the-temporary-config-file-gets-created-and-is.patch --- wpa-2.10/debian/patches/Ensure-the-temporary-config-file-gets-created-and-is.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.10/debian/patches/Ensure-the-temporary-config-file-gets-created-and-is.patch 2026-09-26 14:32:32.000000000 +0200 @@ -0,0 +1,77 @@ +From: Jouni Malinen <[email protected]> +Date: Sun, 23 Aug 2026 11:48:52 +0300 +Subject: Ensure the temporary config file gets created and is not a symlink +Origin: https://git.w1.fi/cgit/hostap/commit/?id=e3937427e702f2efd45b2bd3cdc3e8591c3280e4 +Bug-Debian: https://bugs.debian.org/1148985 + +While the unpredictable file name from commit 4540af010df3 ("Use a +random suffix in the temporary wpa_supplicant configuration file") would +make it challenging to create a symlink with the matching name, this can +be made more robust by using open() with O_EXCL to make sure the +temporary file does not exist. + +Signed-off-by: Jouni Malinen <[email protected]> +--- + wpa_supplicant/config_file.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c +index 4f22e4b10138..8a8c3cc84e5c 100644 +--- a/wpa_supplicant/config_file.c ++++ b/wpa_supplicant/config_file.c +@@ -12,6 +12,7 @@ + + #include "includes.h" + #include <sys/stat.h> ++#include <fcntl.h> + + #include "common.h" + #include "config.h" +@@ -1843,6 +1844,11 @@ static void wpa_config_write_identity(FILE *f, struct wpa_dev_ik *dev_ik) + #endif /* CONFIG_NO_CONFIG_WRITE */ + + ++#if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__) || \ ++ defined(__APPLE__) || defined(__OpenBSD__) ++#define WPAS_CONFIG_USE_OPEN ++#endif ++ + int wpa_config_write(const char *name, struct wpa_config *config) + { + #ifndef CONFIG_NO_CONFIG_WRITE +@@ -1858,7 +1864,11 @@ int wpa_config_write(const char *name, struct wpa_config *config) + size_t tmp_len, prefix_len, suffix_len; + char *tmp_name; + struct stat file_stat; ++#ifdef WPAS_CONFIG_USE_OPEN ++ int fd; ++#else /* WPAS_CONFIG_USE_OPEN */ + mode_t prev; ++#endif /* WPAS_CONFIG_USE_OPEN */ + u8 suffix[8]; + + if (!name) { +@@ -1881,9 +1891,20 @@ int wpa_config_write(const char *name, struct wpa_config *config) + suffix, sizeof(suffix)); + name = tmp_name; + ++#ifdef WPAS_CONFIG_USE_OPEN ++ fd = open(name, O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW, ++ S_IRUSR | S_IWUSR); ++ if (fd < 0) { ++ wpa_printf(MSG_DEBUG, "Failed to create '%s'", name); ++ os_free(tmp_name); ++ return -1; ++ } ++ f = fdopen(fd, "w"); ++#else /* WPAS_CONFIG_USE_OPEN */ + prev = umask(S_IRWXG | S_IRWXO); + f = fopen(name, "w"); + umask(prev); ++#endif /* WPAS_CONFIG_USE_OPEN */ + if (f == NULL) { + wpa_printf(MSG_DEBUG, "Failed to open '%s' for writing", name); + os_free(tmp_name); +-- +2.55.0 + diff -Nru wpa-2.10/debian/patches/Honor-permissions-from-the-wpa_supplicant-configurat.patch wpa-2.10/debian/patches/Honor-permissions-from-the-wpa_supplicant-configurat.patch --- wpa-2.10/debian/patches/Honor-permissions-from-the-wpa_supplicant-configurat.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.10/debian/patches/Honor-permissions-from-the-wpa_supplicant-configurat.patch 2026-09-26 14:32:02.000000000 +0200 @@ -0,0 +1,55 @@ +From: ShengYi Hung <[email protected]> +Date: Sun, 19 Apr 2026 17:02:02 +0800 +Subject: Honor permissions from the wpa_supplicant configuration target file +Origin: https://git.w1.fi/cgit/hostap/commit/?id=e3d1ebda8117c455547b8a9fb06460fb6a405373 +Bug-Debian: https://bugs.debian.org/1148985 + +fwrite() creates file with default permission (rw-r--r--) while the file +does not exist. However, the wpa config file may be installed as +(rw-------), which doesn't want other user to see the password. + +As a result, we honor these permissions from the original file by using +stat and chmod syscalls. + +Signed-off-by: ShengYi Hung <[email protected]> +--- + wpa_supplicant/config_file.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c +index aff50344af63..511f4f88b125 100644 +--- a/wpa_supplicant/config_file.c ++++ b/wpa_supplicant/config_file.c +@@ -11,9 +11,7 @@ + */ + + #include "includes.h" +-#ifdef ANDROID + #include <sys/stat.h> +-#endif /* ANDROID */ + + #include "common.h" + #include "config.h" +@@ -1859,6 +1857,7 @@ int wpa_config_write(const char *name, struct wpa_config *config) + const char *orig_name = name; + int tmp_len; + char *tmp_name; ++ struct stat file_stat; + + if (!name) { + wpa_printf(MSG_ERROR, "No configuration file for writing"); +@@ -1881,6 +1880,11 @@ int wpa_config_write(const char *name, struct wpa_config *config) + return -1; + } + ++ if (stat(orig_name, &file_stat) == 0) ++ chmod(name, ++ (file_stat.st_mode & (S_IRWXU | S_IRWXG | S_IRWXO)) | ++ S_IRUSR | S_IWUSR); ++ + wpa_config_write_global(f, config); + + for (cred = config->cred; cred; cred = cred->next) { +-- +2.55.0 + diff -Nru wpa-2.10/debian/patches/Remove-alternative-wpa_config_write-path-on-failed-m.patch wpa-2.10/debian/patches/Remove-alternative-wpa_config_write-path-on-failed-m.patch --- wpa-2.10/debian/patches/Remove-alternative-wpa_config_write-path-on-failed-m.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.10/debian/patches/Remove-alternative-wpa_config_write-path-on-failed-m.patch 2026-09-26 14:32:32.000000000 +0200 @@ -0,0 +1,64 @@ +From: Jouni Malinen <[email protected]> +Date: Sat, 1 Aug 2026 11:15:37 +0300 +Subject: Remove alternative wpa_config_write() path on failed memory + allocation +Origin: https://git.w1.fi/cgit/hostap/commit/?id=c53b2ce62ee11f0d5d95177feeb031196a5ccd25 +Bug-Debian: https://bugs.debian.org/1148985 + +The memory allocation here for the temporary file name is not really +going to fail in practice and there is no need to maintain two different +approaches for saving the configuration. Remove the unneeded fallback +option to simplify this. + +Signed-off-by: Jouni Malinen <[email protected]> +--- + wpa_supplicant/config_file.c | 23 ++++++++++------------- + 1 file changed, 10 insertions(+), 13 deletions(-) + +diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c +index 0a69aca3605b..613e5cc097a8 100644 +--- a/wpa_supplicant/config_file.c ++++ b/wpa_supplicant/config_file.c +@@ -1867,10 +1867,11 @@ int wpa_config_write(const char *name, struct wpa_config *config) + + tmp_len = os_strlen(name) + 5; /* allow space for .tmp suffix */ + tmp_name = os_malloc(tmp_len); +- if (tmp_name) { +- os_snprintf(tmp_name, tmp_len, "%s.tmp", name); +- name = tmp_name; +- } ++ if (!tmp_name) ++ return -1; ++ ++ os_snprintf(tmp_name, tmp_len, "%s.tmp", name); ++ name = tmp_name; + + wpa_printf(MSG_DEBUG, "Writing configuration file '%s'", name); + +@@ -1932,18 +1933,14 @@ int wpa_config_write(const char *name, struct wpa_config *config) + + fclose(f); + +- if (tmp_name) { +- int chmod_ret = 0; +- + #ifdef ANDROID +- chmod_ret = chmod(tmp_name, +- S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP); ++ if (!ret) ++ ret = chmod(tmp_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP); + #endif /* ANDROID */ +- if (chmod_ret != 0 || rename(tmp_name, orig_name) != 0) +- ret = -1; ++ if (!ret) ++ ret = rename(tmp_name, orig_name); + +- os_free(tmp_name); +- } ++ os_free(tmp_name); + + wpa_printf(MSG_DEBUG, "Configuration file '%s' written %ssuccessfully", + orig_name, ret ? "un" : ""); +-- +2.55.0 + diff -Nru wpa-2.10/debian/patches/Remove-the-temporary-wpa_supplicant-config-file-in-e.patch wpa-2.10/debian/patches/Remove-the-temporary-wpa_supplicant-config-file-in-e.patch --- wpa-2.10/debian/patches/Remove-the-temporary-wpa_supplicant-config-file-in-e.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.10/debian/patches/Remove-the-temporary-wpa_supplicant-config-file-in-e.patch 2026-09-26 14:32:32.000000000 +0200 @@ -0,0 +1,31 @@ +From: Jouni Malinen <[email protected]> +Date: Sat, 1 Aug 2026 11:18:41 +0300 +Subject: Remove the temporary wpa_supplicant config file in error case +Origin: https://git.w1.fi/cgit/hostap/commit/?id=b35d7d48bb646eda965fc4aa7cee750eacd87687 +Bug-Debian: https://bugs.debian.org/1148985 + +There is no need to leave the temporary wpa_supplicant configuration +file in place if it cannot be fully written or if renaming it to the +original location fails. + +Signed-off-by: Jouni Malinen <[email protected]> +--- + wpa_supplicant/config_file.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c +index 613e5cc097a8..ea4a9453c1db 100644 +--- a/wpa_supplicant/config_file.c ++++ b/wpa_supplicant/config_file.c +@@ -1939,6 +1939,8 @@ int wpa_config_write(const char *name, struct wpa_config *config) + #endif /* ANDROID */ + if (!ret) + ret = rename(tmp_name, orig_name); ++ if (ret) ++ unlink(tmp_name); + + os_free(tmp_name); + +-- +2.55.0 + diff -Nru wpa-2.10/debian/patches/Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch wpa-2.10/debian/patches/Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch --- wpa-2.10/debian/patches/Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.10/debian/patches/Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch 2026-09-26 14:31:33.000000000 +0200 @@ -0,0 +1,36 @@ +From: Jouni Malinen <[email protected]> +Date: Mon, 6 Jul 2026 15:33:11 +0300 +Subject: Require network_ctx and AKMP match for accepting PMKSA entry +Origin: https://git.w1.fi/cgit/hostap/commit/?id=de5e73a03c34d83568afb3183b2b28c8d7641a30 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-78807 +Bug-Debian: https://bugs.debian.org/1147510 + +When wpa_supplicant was processing EAPOL-Key msg 1/4 with a PMKID +indicated by the AP/Authenticator, a PMKSA for the same AA was accepted +without enforcing matching network_ctx (i.e., same network configuration +block) and AKMP. This could allow misbehaving APs to make wpa_supplicant +use an unacceptable PMKSA entry that was generated for a different +network for AKMP under certain conditions. This could result in showing +a connection to an incorrect network when an attacker has credentials to +one network in wpa_supplicant configuration, but not to another network. + +Fix this by accepting the PMKID to set the PMKSA for an association only +if the PMKSA with the same PMKID is for the same network and was +generated using the same AKMP. + +Signed-off-by: Jouni Malinen <[email protected]> +--- + src/rsn_supp/wpa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -280,7 +280,7 @@ static int wpa_supplicant_get_pmk(struct + * event before receiving this 1/4 message, so try to find a + * matching PMKSA cache entry here. */ + sm->cur_pmksa = pmksa_cache_get(sm->pmksa, src_addr, pmkid, +- NULL, 0); ++ sm->network_ctx, sm->key_mgmt); + if (sm->cur_pmksa) { + wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, + "RSN: found matching PMKID from PMKSA cache"); diff -Nru wpa-2.10/debian/patches/Use-a-random-suffix-in-the-temporary-wpa_supplicant-.patch wpa-2.10/debian/patches/Use-a-random-suffix-in-the-temporary-wpa_supplicant-.patch --- wpa-2.10/debian/patches/Use-a-random-suffix-in-the-temporary-wpa_supplicant-.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.10/debian/patches/Use-a-random-suffix-in-the-temporary-wpa_supplicant-.patch 2026-09-26 14:32:32.000000000 +0200 @@ -0,0 +1,68 @@ +From: Jouni Malinen <[email protected]> +Date: Sat, 1 Aug 2026 11:20:31 +0300 +Subject: Use a random suffix in the temporary wpa_supplicant configuration + file +Origin: https://git.w1.fi/cgit/hostap/commit/?id=4540af010df3f4d02240757fb0cbff29339a12c3 +Bug-Debian: https://bugs.debian.org/1148985 + +Avoid use of a predictable file name for the the temporary file. + +Signed-off-by: Jouni Malinen <[email protected]> +--- + wpa_supplicant/config_file.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c +index ea4a9453c1db..4f22e4b10138 100644 +--- a/wpa_supplicant/config_file.c ++++ b/wpa_supplicant/config_file.c +@@ -1855,26 +1855,32 @@ int wpa_config_write(const char *name, struct wpa_config *config) + #endif /* CONFIG_NO_CONFIG_BLOBS */ + int ret = 0; + const char *orig_name = name; +- int tmp_len; ++ size_t tmp_len, prefix_len, suffix_len; + char *tmp_name; + struct stat file_stat; + mode_t prev; ++ u8 suffix[8]; + + if (!name) { + wpa_printf(MSG_ERROR, "No configuration file for writing"); + return -1; + } + +- tmp_len = os_strlen(name) + 5; /* allow space for .tmp suffix */ ++ if (os_get_random(suffix, sizeof(suffix)) < 0) ++ return -1; ++ ++ prefix_len = os_strlen(name) + 5; ++ suffix_len = 2 * sizeof(suffix); ++ tmp_len = prefix_len + suffix_len + 1; + tmp_name = os_malloc(tmp_len); + if (!tmp_name) + return -1; + +- os_snprintf(tmp_name, tmp_len, "%s.tmp", name); ++ os_snprintf(tmp_name, tmp_len, "%s.tmp-", name); ++ wpa_snprintf_hex(tmp_name + prefix_len, suffix_len + 1, ++ suffix, sizeof(suffix)); + name = tmp_name; + +- wpa_printf(MSG_DEBUG, "Writing configuration file '%s'", name); +- + prev = umask(S_IRWXG | S_IRWXO); + f = fopen(name, "w"); + umask(prev); +@@ -1884,6 +1890,8 @@ int wpa_config_write(const char *name, struct wpa_config *config) + return -1; + } + ++ wpa_printf(MSG_DEBUG, "Writing configuration file '%s'", name); ++ + if (stat(orig_name, &file_stat) == 0) + chmod(name, + (file_stat.st_mode & (S_IRWXU | S_IRWXG | S_IRWXO)) | +-- +2.55.0 + diff -Nru wpa-2.10/debian/patches/Use-umask-to-limit-access-to-temporary-wpa_supplican.patch wpa-2.10/debian/patches/Use-umask-to-limit-access-to-temporary-wpa_supplican.patch --- wpa-2.10/debian/patches/Use-umask-to-limit-access-to-temporary-wpa_supplican.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.10/debian/patches/Use-umask-to-limit-access-to-temporary-wpa_supplican.patch 2026-09-26 14:32:21.000000000 +0200 @@ -0,0 +1,40 @@ +From: Jouni Malinen <[email protected]> +Date: Sat, 1 Aug 2026 11:10:02 +0300 +Subject: Use umask to limit access to temporary wpa_supplicant configuration + file +Origin: https://git.w1.fi/cgit/hostap/commit/?id=1037cc3678ef316ec65059897a941ac3bcfb44bb +Bug-Debian: https://bugs.debian.org/1148985 + +There is a race condition in fopen() followed by chmod(), so set umask +to limit the initial access to the new temporary file. + +Signed-off-by: Jouni Malinen <[email protected]> +--- + wpa_supplicant/config_file.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c +index 511f4f88b125..0a69aca3605b 100644 +--- a/wpa_supplicant/config_file.c ++++ b/wpa_supplicant/config_file.c +@@ -1858,6 +1858,7 @@ int wpa_config_write(const char *name, struct wpa_config *config) + int tmp_len; + char *tmp_name; + struct stat file_stat; ++ mode_t prev; + + if (!name) { + wpa_printf(MSG_ERROR, "No configuration file for writing"); +@@ -1873,7 +1874,9 @@ int wpa_config_write(const char *name, struct wpa_config *config) + + wpa_printf(MSG_DEBUG, "Writing configuration file '%s'", name); + ++ prev = umask(S_IRWXG | S_IRWXO); + f = fopen(name, "w"); ++ umask(prev); + if (f == NULL) { + wpa_printf(MSG_DEBUG, "Failed to open '%s' for writing", name); + os_free(tmp_name); +-- +2.55.0 + diff -Nru wpa-2.10/debian/patches/Verify-that-fclose-succeeds-on-temporary-configurati.patch wpa-2.10/debian/patches/Verify-that-fclose-succeeds-on-temporary-configurati.patch --- wpa-2.10/debian/patches/Verify-that-fclose-succeeds-on-temporary-configurati.patch 1970-01-01 01:00:00.000000000 +0100 +++ wpa-2.10/debian/patches/Verify-that-fclose-succeeds-on-temporary-configurati.patch 2026-09-26 14:32:32.000000000 +0200 @@ -0,0 +1,36 @@ +From: Jouni Malinen <[email protected]> +Date: Sun, 23 Aug 2026 11:56:50 +0300 +Subject: Verify that fclose() succeeds on temporary configuration file +Origin: https://git.w1.fi/cgit/hostap/commit/?id=50e7efc698f9211717f484614e04f42e4f4f7878 +Bug-Debian: https://bugs.debian.org/1148985 + +Writing the final data from buffers could fail at least in theory, so +verify that fclose() returns success before proceeding with replacing +the actual configuration file. + +Signed-off-by: Jouni Malinen <[email protected]> +--- + wpa_supplicant/config_file.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c +index 8a8c3cc84e5c..d77a5b02e946 100644 +--- a/wpa_supplicant/config_file.c ++++ b/wpa_supplicant/config_file.c +@@ -1960,7 +1960,12 @@ int wpa_config_write(const char *name, struct wpa_config *config) + + os_fdatasync(f); + +- fclose(f); ++ if (fclose(f) != 0) { ++ wpa_printf(MSG_DEBUG, ++ "fclose() failed ton temporary configuration file: %s", ++ strerror(errno)); ++ ret = -1; ++ } + + #ifdef ANDROID + if (!ret) +-- +2.55.0 + diff -Nru wpa-2.10/debian/patches/series wpa-2.10/debian/patches/series --- wpa-2.10/debian/patches/series 2025-11-08 10:09:39.000000000 +0100 +++ wpa-2.10/debian/patches/series 2026-09-26 14:32:32.000000000 +0200 @@ -19,3 +19,11 @@ CVE-2024-5290-lib_engine_trusted_path.patch 0019-Send-CTRL-EVENT-SIGNAL-CHANGE-message-to-control-int.patch Bump-DEFAULT_BSS_MAX_COUNT-to-1000.patch +Require-network_ctx-and-AKMP-match-for-accepting-PMK.patch +Honor-permissions-from-the-wpa_supplicant-configurat.patch +Use-umask-to-limit-access-to-temporary-wpa_supplican.patch +Remove-alternative-wpa_config_write-path-on-failed-m.patch +Remove-the-temporary-wpa_supplicant-config-file-in-e.patch +Use-a-random-suffix-in-the-temporary-wpa_supplicant-.patch +Ensure-the-temporary-config-file-gets-created-and-is.patch +Verify-that-fclose-succeeds-on-temporary-configurati.patch
