Denial of Service Vulnerability in hostapd: CVE-2019-9496
Summary
ALPINE-CVE-2019-9496: An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. Affects hostapd versions < 2.8-r0. Fixed in 2.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
hostapd is a user space daemon for access point and authentication servers. It enables the creation of wireless access points and provides authentication services for clients. The package supports various authentication protocols, including SAE (Simultaneous Authentication of Equals). However, hostapd versions with SAE support are vulnerable to a specific denial of service attack due to improper state validation when processing authentication messages.
Vulnerability Detail
An invalid authentication sequence could lead to the termination of the hostapd process due to missing state validation steps when processing the SAE confirm message in AP mode. This vulnerability affects all versions of hostapd that support SAE, allowing an attacker to force the hostapd process to terminate, resulting in a denial of service. The vulnerability is particularly critical as it can disrupt wireless services and affect connected clients.
How To Fix
Minimum fixed version
2.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade hostapdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable SAE support in hostapd configuration to mitigate the risk until the package is updated. This can be done by modifying the hostapd configuration file to exclude SAE settings.
Conclusion
CVE-2019-9496 represents a significant denial of service vulnerability in hostapd, affecting all versions with SAE support prior to 2.8-r0. Users are encouraged to update their hostapd installations to the patched version to mitigate the risk of service disruption.
See every vulnerability recorded for hostapd →
FAQ
CVE-2019-9496 is a vulnerability in hostapd that allows attackers to exploit improper state validation, leading to a denial of service.
All versions of hostapd with SAE support prior to version 2.8-r0 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of CVE-2019-9496 is 7.5, indicating a high severity level.
If you cannot update hostapd right away, consider disabling SAE support in your configuration as a temporary measure to reduce risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for hostapd.
