CVE-2019-9495
Description
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
How to fix
- synology router_manager1.2.3-8017 or later
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDOZGR3T7FVO5JSZWK2QPR7AOFIEJTIZ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVMJOFEYBGXZLFF5IOLW67SSOPKFEJP3/
- security.freebsd.org/advisories/FreeBSD-SA-19:03.wpa.asc
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| w1.fi hostapd | v ≤ 2.7 | — |
| w1.fi wpa_supplicant | v ≤ 2.7 | — |
| fedoraproject fedora | 28, 29, 30 | — |
| opensuse backports_sle | 15.0 | — |
| opensuse leap | 15.1 | — |
| synology radius_server | 3.0 | — |
| synology router_manager | v < 1.2.3-8017 | 1.2.3-8017 |
| debian debian_linux | 8.0 | — |
| freebsd freebsd | 11.2, 12.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.