java-topology/defects/zephyr-0002/patch/zephyr-0002.patch

37 lines
1.9 KiB
Diff

# UNDF: UNDF-2026-000001182
--- a/subsys/net/l2/wifi/wifi_mgmt.c
+++ b/subsys/net/l2/wifi/wifi_mgmt.c
@@ -396,9 +396,14 @@ static int wifi_connect(uint64_t mgmt_request, struct net_if *iface,
# Defect ID: zephyr-0002
# MOAD: 0004
# Severity: HIGH
# CVE class: CWE-312 Cleartext Storage/Exposure of Sensitive Information
#
# Root cause: wifi_connect() in wifi_mgmt.c dumps the WiFi PSK and SAE
# password as raw hex via LOG_HEXDUMP_DBG on every connection attempt:
#
# line 396: LOG_HEXDUMP_DBG(params->ssid, params->ssid_length, "ssid");
# line 397: LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");
# line 399: LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");
#
# LOG_HEXDUMP_DBG fires at LOG_LEVEL_DBG. When a developer or board BSP sets
# CONFIG_WIFI_LOG_LEVEL_DBG=y (common during WiFi bring-up and certification
# testing), the PSK is dumped to the Zephyr logging backend in hex. On boards
# with RTT, UART, or flash logging backends this exposes the network passphrase
# in cleartext to anyone with console or log access.
#
# The SSID is not a credential and is fine to log. The PSK and SAE password
# must not appear in logs at any log level.
#
# Fix: remove LOG_HEXDUMP_DBG for psk and sae_password. Log only the SSID,
# channel and security type (already logged by NET_DBG two lines below).
LOG_HEXDUMP_DBG(params->ssid, params->ssid_length, "ssid");
- LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");
- if (params->sae_password) {
- LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");
- }
+ /* PATCH zephyr-0002: do not log PSK or SAE password (CWE-312). */
+ LOG_DBG("psk set: %s", params->psk_length > 0 ? "yes" : "no");
+ LOG_DBG("sae_password set: %s", (params->sae_password && params->sae_password_length > 0) ? "yes" : "no");
NET_DBG("ch %u sec %u", params->channel, params->security);