SB2025031214 - Multiple vulnerabilities in hostapd

Description

This security bulletin contains information about 2 vulnerabilities.

1) Premature Release of Resource During Expected Lifetime (CVE-ID: CVE-2025-24912)

CWE-ID: CWE-826 - Premature Release of Resource During Expected Lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected application fails to process crafted RADIUS packets properly. A remote attacker can perform a man-in-the-middle (MitM) attack and cause a denial of service condition on the target system.

2) Information disclosure (CVE-ID: CVE-2022-37660)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way hostapd handles PKEX associations. A remote attacker can re-use public keys in order to gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://jvn.jp/en/jp/JVN19358384/index.html
• https://link.springer.com/article/10.1007/s10207-025-00988-3
• https://w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4