CVE-2022-23304
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
The EAP-pwd implementations in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks due to cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9495.
Risk Assessment
An attacker can exploit this vulnerability to recover passwords or authentication keys, leading to a breach of confidentiality and integrity of network communications.
Recommendation
Immediately update hostapd and wpa_supplicant to version 2.10 or later, which includes a complete fix eliminating the side-channel vulnerability.
Other vulnerabilities in hostapd/wpa_supplicant
See all- CVE-2016-4476High
Versions of hostapd from 0.6.7 to 2.5 and wpa_supplicant from 0.6.7 to 2.5 do not reject and characters in passphrase parameters, allowing remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.
- CVE-2022-23303Critical
The SAE protocol implementations in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks due to cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9494.
Original NVD description (English source)
The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.