37 lines
1.9 KiB
Diff
37 lines
1.9 KiB
Diff
# UNDF: UNDF-2026-000001182
|
|
--- a/subsys/net/l2/wifi/wifi_mgmt.c
|
|
+++ b/subsys/net/l2/wifi/wifi_mgmt.c
|
|
@@ -396,9 +396,14 @@ static int wifi_connect(uint64_t mgmt_request, struct net_if *iface,
|
|
# Defect ID: zephyr-0002
|
|
# MOAD: 0004
|
|
# Severity: HIGH
|
|
# CVE class: CWE-312 Cleartext Storage/Exposure of Sensitive Information
|
|
#
|
|
# Root cause: wifi_connect() in wifi_mgmt.c dumps the WiFi PSK and SAE
|
|
# password as raw hex via LOG_HEXDUMP_DBG on every connection attempt:
|
|
#
|
|
# line 396: LOG_HEXDUMP_DBG(params->ssid, params->ssid_length, "ssid");
|
|
# line 397: LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");
|
|
# line 399: LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");
|
|
#
|
|
# LOG_HEXDUMP_DBG fires at LOG_LEVEL_DBG. When a developer or board BSP sets
|
|
# CONFIG_WIFI_LOG_LEVEL_DBG=y (common during WiFi bring-up and certification
|
|
# testing), the PSK is dumped to the Zephyr logging backend in hex. On boards
|
|
# with RTT, UART, or flash logging backends this exposes the network passphrase
|
|
# in cleartext to anyone with console or log access.
|
|
#
|
|
# The SSID is not a credential and is fine to log. The PSK and SAE password
|
|
# must not appear in logs at any log level.
|
|
#
|
|
# Fix: remove LOG_HEXDUMP_DBG for psk and sae_password. Log only the SSID,
|
|
# channel and security type (already logged by NET_DBG two lines below).
|
|
|
|
LOG_HEXDUMP_DBG(params->ssid, params->ssid_length, "ssid");
|
|
- LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");
|
|
- if (params->sae_password) {
|
|
- LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");
|
|
- }
|
|
+ /* PATCH zephyr-0002: do not log PSK or SAE password (CWE-312). */
|
|
+ LOG_DBG("psk set: %s", params->psk_length > 0 ? "yes" : "no");
|
|
+ LOG_DBG("sae_password set: %s", (params->sae_password && params->sae_password_length > 0) ? "yes" : "no");
|
|
NET_DBG("ch %u sec %u", params->channel, params->security);
|