From 0877efe2eb2236cb4ec308cea02386a20df4a1ab Mon Sep 17 00:00:00 2001 From: Abtin Keshavarzian Date: Wed, 29 Apr 2020 10:55:51 -0700 Subject: [PATCH] [mac] verify that Security Level is correct in rx frame (#4905) This commit adds a check in `Mac::ProcessReceiveSecurity()` to verify that the Security Level in the received frame is properly set to `kSecEncMic32` before trying to decrypt and validate the frame. This helps avoid performing AES-CCM when frame is invalid and also avoid potentially reading beyond the frame length when checking MIC/footer. --- src/core/mac/mac.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/core/mac/mac.cpp b/src/core/mac/mac.cpp index c1b3590b7..11ef6052d 100644 --- a/src/core/mac/mac.cpp +++ b/src/core/mac/mac.cpp @@ -1446,6 +1446,8 @@ otError Mac::ProcessReceiveSecurity(RxFrame &aFrame, const Address &aSrcAddr, Ne VerifyOrExit(aFrame.GetSecurityEnabled(), error = OT_ERROR_NONE); aFrame.GetSecurityLevel(securityLevel); + VerifyOrExit(securityLevel == Frame::kSecEncMic32, OT_NOOP); + aFrame.GetFrameCounter(frameCounter); otLogDebgMac("Rx security - frame counter %u", frameCounter);