Multiple vulnerabilities in hostapd and wpa_supplicant

Published: 2022-01-19

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-23303 CVE-2022-23304
CWE-ID	CWE-327
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	hostapd Server applications / Remote access servers, VPN wpa_supplicant Server applications / Encryption software
Vendor	Jouni Malinen

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU59839

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23303

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists due to the implementations of SAE are vulnerable to side-channel attacks as a result of cache access patterns. A remote attacker with ability to install and execute applications can crack weak passwords when memory access patterns are visible in a shared cache.

Note, this vulnerability exists due to incomplete fix for #VU23959 (CVE-2019-9494).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

hostapd: 2.0 - 2.9

wpa_supplicant: 2.0 - 2.9

External links

http://w1.fi/security/2022-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU59838