From 59499c73611c9c338cae97fb0c1fca5894653e1f Mon Sep 17 00:00:00 2001 From: David Gauchard Date: Mon, 27 Jul 2020 00:09:26 +0200 Subject: [PATCH] backport #7486 --- libraries/ESP8266WiFi/src/ESP8266WiFiGeneric.cpp | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/libraries/ESP8266WiFi/src/ESP8266WiFiGeneric.cpp b/libraries/ESP8266WiFi/src/ESP8266WiFiGeneric.cpp index 41d771fb6..2a5f96cb5 100644 --- a/libraries/ESP8266WiFi/src/ESP8266WiFiGeneric.cpp +++ b/libraries/ESP8266WiFi/src/ESP8266WiFiGeneric.cpp @@ -233,6 +233,16 @@ void ESP8266WiFiGenericClass::_eventCallback(void* arg) WiFiClient::stopAll(); } + if (event->event == EVENT_STAMODE_AUTHMODE_CHANGE) { + auto& src = event->event_info.auth_change; + if ((src.old_mode != AUTH_OPEN) && (src.new_mode == AUTH_OPEN)) { + // CVE-2020-12638 workaround. When we get a change to AUTH_OPEN from any other mode, drop the WiFi link because it's a downgrade attack + // TODO - When upgrading to 3.x.x with fix, remove this code + DEBUG_WIFI("WIFI_EVENT_STAMODE_AUTHMODE_CHANGE from encrypted(%d) to AUTH_OPEN, potential downgrade attack. Reconnecting WiFi. See CVE-2020-12638 for more details\n", src.old_mode); + WiFi.reconnect(); // Disconnects from STA and then reconnects + } + } + for(auto it = std::begin(sCbEventList); it != std::end(sCbEventList); ) { WiFiEventHandler &handler = *it; if (handler->canExpire() && handler.unique()) {