Premature Release of Resource During Expected Lifetime in hostapd - CVE-2025-24912

Vulnerability identifier: #VU105624

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-24912

CWE-ID: CWE-826

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected application fails to process crafted RADIUS packets properly. A remote attacker can perform a man-in-the-middle (MitM) attack and cause a denial of service condition on the target system.

hostapd
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Basesystem Module
openSUSE Leap
openEuler
wpa_supplicant-help
wpa_supplicant-gui
wpa_supplicant-debugsource
wpa_supplicant-debuginfo
wpa_supplicant
wpa_supplicant-gui-debuginfo

Install updates from vendor's website.

wpa_supplicant-help - addressed in versions 2.6-33, 2.10-8, 2.11-8
wpa_supplicant-gui - addressed in versions 2.6-33, 2.10-8, 2.11-8
wpa_supplicant-debugsource - addressed in versions 2.6-33, 2.10-8, 2.11-8
wpa_supplicant-debuginfo - addressed in versions 2.6-33, 2.10-8, 2.11-8
wpa_supplicant - addressed in versions 2.6-33, 2.10-8, 2.11-8
wpa_supplicant-debuginfo - addressed in versions 2.9-23.23.1, 2.9-150000.4.42.1, 2.10-150500.3.6.1, 2.10-150600.7.6.1
wpa_supplicant-debugsource - addressed in versions 2.9-23.23.1, 2.9-150000.4.42.1, 2.10-150500.3.6.1, 2.10-150600.7.6.1
wpa_supplicant - addressed in versions 2.9-23.23.1, 2.9-150000.4.42.1, 2.10-150500.3.6.1, 2.10-150600.7.6.1
wpa_supplicant-gui-debuginfo - addressed in versions 2.10-150500.3.6.1, 2.10-150600.7.6.1
wpa_supplicant-gui - addressed in versions 2.10-150500.3.6.1, 2.10-150600.7.6.1

• https://jvn.jp/en/jp/JVN19358384/index.html

• Multiple vulnerabilities in hostapd
• SUSE update for wpa_supplicant
• openEuler 24.03 LTS update for wpa_supplicant
• openEuler 22.03 LTS SP4 update for wpa_supplicant
• SUSE update for wpa_supplicant
• openEuler 24.03 LTS SP1 update for wpa_supplicant
• SUSE update for wpa_supplicant
• SUSE update for wpa_supplicant