Information disclosure in wpa_supplicant and hostapd - CVE-2019-13377

Vulnerability identifier: #VU20415

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-13377

CWE-ID: CWE-200

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to conduct time-based side-channel attacks on a targeted system.

The vulnerability exists due to insufficient security restrictions during the WPA3's Dragonfly handshake process when using Brainpool curves. A remote in radio range of the access point can observe timing differences and cache access patterns, conduct a side-channel attack and access sensitive information that could be used for full password recovery.

wpa_supplicant
hostapd
wpa (Debian package)
wpa (Ubuntu package)
hostapd (Alpine package)
wpa_supplicant (Alpine package)
wpa_supplicant-help
wpa_supplicant-gui
wpa_supplicant
wpa_supplicant-debuginfo
wpa_supplicant-debugsource
hostapd
Fedora
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
openEuler

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

wpa (Debian package) - update to 2:2.7+git20190128+0c1e29f-6+deb10u1
wpa (Ubuntu package) - addressed in versions 2:2.6-15ubuntu2.4, 2:2.6-21ubuntu3.2
hostapd (Alpine package) - addressed in versions 2.7-r4, 2.8-r1
wpa_supplicant (Alpine package) - update to 2.7-r4
wpa_supplicant-help - update to 2.6-27
wpa_supplicant-gui - update to 2.6-27
wpa_supplicant - update to 2.6-27
wpa_supplicant-debuginfo - update to 2.6-27
wpa_supplicant-debugsource - update to 2.6-27
hostapd - addressed in versions 2.9-1.el7, 2.9-1.fc30
wpa_supplicant-debugsource - update to 2.9-15.22.1
wpa_supplicant-debuginfo - update to 2.9-15.22.1
wpa_supplicant - update to 2.9-15.22.1

• https://w1.fi/cgit/hostap/commit/?id=147bf7b88a9c231322b5b574263071ca6dbb0503
• https://w1.fi/cgit/hostap/commit/?id=cd803299ca485eb857e37c88f973fccfbb8600e5
• https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-attack-update.txt

• Ubuntu update for wpa_supplicant and hostapd
• Debian update for wpa
• Information disclosure in hostapd (Alpine package)
• Information disclosure in wpa_supplicant (Alpine package)
• SUSE update for wpa_supplicant
• openEuler update for wpa_supplicant
• Fedora 30 update for hostapd
• Fedora EPEL 7 update for hostapd