[Buildroot] [git commit] package/wpa_supplicant: security bump to 2.12

Julien Olivain via buildroot <[email protected]>
Newsgroups net.busybox.buildroot
Message-ID <[email protected]> 
commit: https://gitlab.com/buildroot.org/buildroot/-/commit/9ec3435c0add9c5fc8310fa65f40b076aa121609
branch: https://gitlab.com/buildroot.org/buildroot/-/tree/master

See here for a Changelog:
https://git.w1.fi/cgit/hostap/tree/wpa_supplicant/ChangeLog?id=e6386389448a4e0ec568fa7a27026e03f95bb768

Security issues fixed in this release:
https://w1.fi/security/2026-4/incomplete-bounds-checking-of-mesh-ampe-messages-in-wpa_supplicant.txt
https://w1.fi/security/2026-3/unexpected-sae-commit-message-contents-terminating-wpa_suppliant.txt
https://w1.fi/security/2026-2/missing-network-context-validation-for-pmksa-caching.txt
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt

Patches 0001 and 0002 are upstream.

Tested on Raspberry PI4 (64 Bit).

License changed:
-Copyright (c) 2002-2024, Jouni Malinen <[email protected]> and contributors
+Copyright (c) 2002-2026, Jouni Malinen <[email protected]> and contributors

Signed-off-by: Waldemar Brodkorb <[email protected]>
Signed-off-by: Julien Olivain <[email protected]>
---
 ...-authorization-completed-on-driver-indica.patch | 55 ----------------------
 ...x-Hardware-offload-requires-Linux-headers.patch | 53 ---------------------
 package/wpa_supplicant/wpa_supplicant.hash         |  4 +-
 package/wpa_supplicant/wpa_supplicant.mk           |  2 +-
 4 files changed, 3 insertions(+), 111 deletions(-)

diff --git a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch b/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
deleted file mode 100644
index 89954eb7c5..0000000000
--- a/package/wpa_supplicant/0001-Revert-Mark-authorization-completed-on-driver-indica.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 170d8a433308ee39f87af94acaef461f8e80b67b Mon Sep 17 00:00:00 2001
-From: Janne Grunau <[email protected]>
-Date: Sun, 4 Aug 2024 13:24:42 +0200
-Subject: [PATCH] Revert "Mark authorization completed on driver indication during 4-way HS offload"
-
-This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5.
-
-Signed-off-by: Janne Grunau <[email protected]>
-Signed-off-by: Sergey Matyukevich <[email protected]>
-
-Upstream: not yet sent, ongoing discussion http://lists.infradead.org/pipermail/hostap/2024-August/042893.html
-
----
- wpa_supplicant/events.c | 25 ++++++++-----------------
- 1 file changed, 8 insertions(+), 17 deletions(-)
-
-diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
-index 49917f7aa..bbb3a3eda 100644
---- a/wpa_supplicant/events.c
-+++ b/wpa_supplicant/events.c
-@@ -4327,23 +4327,14 @@ static void wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
- 		eapol_sm_notify_eap_success(wpa_s->eapol, true);
- 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK) &&
- 		   wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) {
--		if (already_authorized) {
--			/*
--			 * We are done; the driver will take care of RSN 4-way
--			 * handshake.
--			 */
--			wpa_supplicant_cancel_auth_timeout(wpa_s);
--			wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
--			eapol_sm_notify_portValid(wpa_s->eapol, true);
--			eapol_sm_notify_eap_success(wpa_s->eapol, true);
--		} else {
--			/* Update port, WPA_COMPLETED state from the
--			 * EVENT_PORT_AUTHORIZED handler when the driver is done
--			 * with the 4-way handshake.
--			 */
--			wpa_msg(wpa_s, MSG_DEBUG,
--				"ASSOC INFO: wait for driver port authorized indication");
--		}
-+		/*
-+		 * We are done; the driver will take care of RSN 4-way
-+		 * handshake.
-+		 */
-+		wpa_supplicant_cancel_auth_timeout(wpa_s);
-+		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
-+		eapol_sm_notify_portValid(wpa_s->eapol, true);
-+		eapol_sm_notify_eap_success(wpa_s->eapol, true);
- 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) &&
- 		   wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
- 		/*
--- 
-2.45.2
-
diff --git a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch b/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
deleted file mode 100644
index 7330319d06..0000000000
--- a/package/wpa_supplicant/0002-macsec_linux-Hardware-offload-requires-Linux-headers.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 809d9d8172db8e2a08ff639875f838b5b86d2641 Mon Sep 17 00:00:00 2001
-From: Sergey Matyukevich <[email protected]>
-Date: Thu, 22 Aug 2024 00:03:41 +0300
-Subject: [PATCH] macsec_linux: Hardware offload requires Linux headers >= v5.7
-
-Hardware offload in Linux macsec driver is enabled in compile time if
-libnl version is >= v3.6. This is not sufficient for successful build
-since enum 'macsec_offload' has been added to Linux header if_link.h
-in kernels v5.6 and v5.7, see commits:
-- https://github.com/torvalds/linux/commit/21114b7feec29e4425a3ac48a037569c016a46c8
-- https://github.com/torvalds/linux/commit/76564261a7db80c5f5c624e0122a28787f266bdf
-
-New libnl with older Linux headers is a valid combination. This is how
-hostapd build failure has been detected by Buildroot autobuilder, see:
-- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/
-
-Extend compile time condition for the enablement of the macsec hardware
-offload adding Linux headers version check.
-
-Fixes: 40c139664439 ("macsec_linux: Add support for MACsec hardware offload")
-Signed-off-by: Sergey Matyukevich <[email protected]>
-
-Upstream: https://w1.fi/cgit/hostap/commit/?id=809d9d8172db8e2a08ff639875f838b5b86d2641
-
----
- src/drivers/driver_macsec_linux.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/src/drivers/driver_macsec_linux.c b/src/drivers/driver_macsec_linux.c
-index c86715498..fad47a292 100644
---- a/src/drivers/driver_macsec_linux.c
-+++ b/src/drivers/driver_macsec_linux.c
-@@ -19,6 +19,7 @@
- #include <netlink/route/link.h>
- #include <netlink/route/link/macsec.h>
- #include <linux/if_macsec.h>
-+#include <linux/version.h>
- #include <inttypes.h>
- 
- #include "utils/common.h"
-@@ -32,7 +33,8 @@
- 
- #define UNUSED_SCI 0xffffffffffffffff
- 
--#if LIBNL_VER_NUM >= LIBNL_VER(3, 6)
-+#if (LIBNL_VER_NUM >= LIBNL_VER(3, 6) && \
-+     LINUX_VERSION_CODE >= KERNEL_VERSION(5, 7, 0))
- #define LIBNL_HAS_OFFLOAD
- #endif
- 
--- 
-2.46.0
-
diff --git a/package/wpa_supplicant/wpa_supplicant.hash b/package/wpa_supplicant/wpa_supplicant.hash
index 2f38dc257a..bea1e99b1f 100644
--- a/package/wpa_supplicant/wpa_supplicant.hash
+++ b/package/wpa_supplicant/wpa_supplicant.hash
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a  wpa_supplicant-2.11.tar.gz
-sha256  f1b5992bbdd015c3ccb7faaadd62ef58ed821e15b9329bf2ceb27511ccc3f562  README
+sha256  08e23937e16d0155e55cab2b51f51fbe10d80a1aa91c4e15442645059b737ef6  wpa_supplicant-2.12.tar.gz
+sha256  83be1b142c59ccf0d6c5dde0695d8f84dfba109bea058e78ec2942389ccf327f  README
diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
index fe4bc34d55..93ac228947 100644
--- a/package/wpa_supplicant/wpa_supplicant.mk
+++ b/package/wpa_supplicant/wpa_supplicant.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-WPA_SUPPLICANT_VERSION = 2.11
+WPA_SUPPLICANT_VERSION = 2.12
 WPA_SUPPLICANT_SITE = http://w1.fi/releases
 WPA_SUPPLICANT_LICENSE = BSD-3-Clause
 WPA_SUPPLICANT_LICENSE_FILES = README
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.