Timing Attack Vulnerability in Hostapd and WPA Supplicant Packages
Summary
ALPINE-CVE-2019-13377: The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are... Affects hostapd versions < 2.8-r1. Fixed in 2.8-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hostapd and WPA Supplicant are essential components in wireless networking, providing functionalities for authentication and association with wireless networks. Hostapd acts as an access point and authentication server, while WPA Supplicant is responsible for managing the connection to the wireless network. Both packages are widely used in various Linux distributions, including Alpine Linux. However, versions 2.x through 2.8 of these packages are vulnerable to side-channel attacks due to observable timing differences and cache access patterns when using Brainpool curves.
Vulnerability Detail
The vulnerability arises from the implementations of SAE and EAP-pwd in Hostapd and WPA Supplicant, which can be exploited through side-channel attacks. An attacker may leverage timing differences and cache access patterns to extract sensitive information, potentially leading to full password recovery. This vulnerability is particularly concerning as it affects the security of wireless communications, allowing unauthorized access to network credentials.
How To Fix
Minimum fixed version
2.8-r1
This is the first release that contains the fix.
sudo apk add --upgrade hostapdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Brainpool curves in their configurations until the packages are updated. This may involve modifying the configuration files for Hostapd and WPA Supplicant to use alternative cryptographic curves that are not affected by this vulnerability.
Conclusion
The vulnerability in Hostapd and WPA Supplicant poses a significant risk to wireless network security due to the potential for side-channel attacks. It is crucial for users to update their packages to the patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in open-source software effectively.
See every vulnerability recorded for hostapd →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
Hostapd and WPA Supplicant versions 2.x through 2.8 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Brainpool curves are a set of elliptic curves defined for use in cryptographic applications, providing a balance between security and performance.
If immediate updates are not possible, consider using alternative cryptographic curves in your configurations as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for hostapd.
