Side-Channel Attacks in EAP-pwd Implementation in hostapd and wpa_supplicant
Summary
CVE-2022-23304: The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. Affects hostapd versions < 2.9-r4. Fixed in 2.9-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hostapd and wpa_supplicant packages are widely used for managing wireless networks. They provide functionality for access point management and Wi-Fi client connections. These packages are commonly used in the Alpine Linux distributions, specifically versions 3.12 to 3.18. However, these versions are vulnerable to side-channel attacks in the EAP-pwd implementation.
Vulnerability Detail
The vulnerability, identified as CVE-2022-23304, stems from cache access patterns in the EAP-pwd implementation of hostapd and wpa_supplicant. This vulnerability is a result of an incomplete fix for a previous vulnerability, CVE-2019-9495. Attackers can exploit this vulnerability to perform side-channel attacks, potentially leading to unauthorized access, data leakage, or other malicious activities.
How To Fix
Minimum fixed version
2.9-r4
This is the first release that contains the fix.
sudo apk add --upgrade hostapdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the recommended fix by updating the affected packages is the best course of action.
Conclusion
The EAP-pwd implementation in hostapd and wpa_supplicant versions before 2.10 is vulnerable to side-channel attacks. To mitigate this vulnerability, it is crucial to update the affected packages to version 2.10 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hostapd →
FAQ
This vulnerability can allow attackers to perform side-channel attacks, potentially leading to unauthorized access, data leakage, or other malicious activities.
Versions before 2.10 of both hostapd and wpa_supplicant are affected by this vulnerability.
There is no specific information about known exploits for this vulnerability at the moment.
The recommended mitigation is to update the affected packages to version 2.10 or later.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
Related vulnerabilities
Recent vulnerabilities recorded for hostapd.
