[Medium] wpa_supplicant: Fix CVE-2023-52160

[v-smalavathu]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

wpa_supplicant: Fix CVE-2023-52160

Change Log

• newfile: SPECS/wpa_supplicant/CVE-2023-52160.patch
• modified: SPECS/wpa_supplicant/wpa_supplicant.spec

Does this affect the toolchain?

NO

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2023-52160

Test Methodology

• Pipeline build id: xxxx

[0xba1a]

Prep Section. Patch got applied successfully.

time="2025-02-05T06:43:02Z" level=debug msg="Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.t1K9NM"
time="2025-02-05T06:43:02Z" level=debug msg="+ umask 022"
time="2025-02-05T06:43:02Z" level=debug msg="+ cd /usr/src/azl/BUILD"
time="2025-02-05T06:43:02Z" level=debug msg="+ /usr/lib/rpm/azl/gen-ld-script.sh wpa_supplicant 2.10-2.azl3 /usr/src/azl 3.0.20250205.0642"
time="2025-02-05T06:43:02Z" level=debug msg="gen-ld-script.sh name(wpa_supplicant) version(2.10-2.azl3) _topdir(/usr/src/azl) osversion(3.0.20250205.0642)"
time="2025-02-05T06:43:02Z" level=debug msg="==== ELF note generator v2.1.2 ===="
time="2025-02-05T06:43:02Z" level=debug msg="outdir is: /usr/src/azl/BUILD/"
time="2025-02-05T06:43:02Z" level=debug msg="Stamp method: LinkerOnly"
time="2025-02-05T06:43:02Z" level=debug
time="2025-02-05T06:43:02Z" level=debug msg="#ifndef _AUTO_MODULE_INFO_H_"
time="2025-02-05T06:43:02Z" level=debug msg="#define _AUTO_MODULE_INFO_H_"
time="2025-02-05T06:43:02Z" level=debug
time="2025-02-05T06:43:02Z" level=debug msg="#define MODULE_VERSION      \"2.10.0.0\""
time="2025-02-05T06:43:02Z" level=debug msg="#define PACKAGE_VERSION     \"2.10-2.azl3\""
time="2025-02-05T06:43:02Z" level=debug msg="#define PACKAGE_NAME        \"wpa_supplicant\""
time="2025-02-05T06:43:02Z" level=debug msg="#define TARGET_OS           \"mariner\""
time="2025-02-05T06:43:02Z" level=debug msg="#define TARGET_OS_VERSION   \"3.0\""
time="2025-02-05T06:43:02Z" level=debug
time="2025-02-05T06:43:02Z" level=debug msg="#endif //_AUTO_MODULE_INFO_H_"
time="2025-02-05T06:43:02Z" level=debug msg="Generated /usr/src/azl/BUILD/auto_module_info.h file..."
time="2025-02-05T06:43:02Z" level=debug
time="2025-02-05T06:43:02Z" level=debug msg="Successfully generated module_info.ld and .note.package files..."
time="2025-02-05T06:43:02Z" level=debug msg="+ cd /usr/src/azl/BUILD"
time="2025-02-05T06:43:02Z" level=debug msg="+ rm -rf wpa_supplicant-2.10"
time="2025-02-05T06:43:02Z" level=debug msg="+ /usr/lib/rpm/rpmuncompress -x /usr/src/azl/SOURCES/wpa_supplicant-2.10.tar.gz"
time="2025-02-05T06:43:02Z" level=debug msg="+ STATUS=0"
time="2025-02-05T06:43:02Z" level=debug msg="+ '[' 0 -ne 0 ']'"
time="2025-02-05T06:43:02Z" level=debug msg="+ cd wpa_supplicant-2.10"
time="2025-02-05T06:43:02Z" level=debug msg="+ /bin/chmod -Rf a+rX,u+w,g-w,o-w ."
time="2025-02-05T06:43:02Z" level=debug msg="+ /usr/lib/rpm/rpmuncompress /usr/src/azl/SOURCES/CVE-2023-52160.patch"
time="2025-02-05T06:43:02Z" level=debug msg="+ /bin/patch -p1 -s --fuzz=0 --no-backup-if-mismatch -f"
time="2025-02-05T06:43:02Z" level=debug msg="+ RPM_EC=0"
time="2025-02-05T06:43:02Z" level=debug msg="++ jobs -p"
time="2025-02-05T06:43:02Z" level=debug msg="+ exit 0"

[0xba1a]

Visually compared the patch with original patch from https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439c.