SB2025031214 - Multiple vulnerabilities in hostapd

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Premature Release of Resource During Expected Lifetime (CVE-ID: CVE-2025-24912)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected application fails to process crafted RADIUS packets properly. A remote attacker can perform a man-in-the-middle (MitM) attack and cause a denial of service condition on the target system.

2) Information disclosure (CVE-ID: CVE-2022-37660)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way hostapd handles PKEX associations. A remote attacker can re-use public keys in order to gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://jvn.jp/en/jp/JVN19358384/index.html
• https://link.springer.com/article/10.1007/s10207-025-00988-3
• https://w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4