CVE-2022-23303
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
The SAE protocol implementations in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks due to cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9494.
Risk Assessment
An attacker can exploit cache-based information leaks to recover authentication credentials or session keys, compromising the confidentiality of Wi-Fi communication in networks using WPA3.
Recommendation
Immediately update hostapd and wpa_supplicant to version 2.10 or later, which includes the complete fix mitigating side-channel vulnerabilities.
Other vulnerabilities in hostapd/wpa_supplicant
See all- CVE-2016-4476High
Versions of hostapd from 0.6.7 to 2.5 and wpa_supplicant from 0.6.7 to 2.5 do not reject and characters in passphrase parameters, allowing remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.
- CVE-2022-23304Critical
The EAP-pwd implementations in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks due to cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9495.
Original NVD description (English source)
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.