Описание
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 2:2.6-15ubuntu2.2 |
| cosmic | released | 2:2.6-18ubuntu1.1 |
| devel | released | 2:2.6-21ubuntu3 |
| disco | released | 2:2.6-21ubuntu3 |
| esm-infra-legacy/trusty | released | 2.1-0ubuntu1.7 |
| esm-infra/bionic | released | 2:2.6-15ubuntu2.2 |
| esm-infra/xenial | released | 2.4-0ubuntu6.4 |
| precise/esm | DNE | |
| trusty | released | 2.1-0ubuntu1.7 |
| trusty/esm | released | 2.1-0ubuntu1.7 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| cosmic | DNE | |
| devel | DNE | |
| disco | DNE | |
| esm-infra-legacy/trusty | DNE | |
| precise/esm | not-affected | code not present |
| trusty | DNE | |
| trusty/esm | DNE | |
| upstream | needs-triage | |
| xenial | DNE |
Показывать по
EPSS
4.3 Medium
CVSS2
3.7 Low
CVSS3
Связанные уязвимости
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulne ...
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
Уязвимость реализации протокола EAP-PWD сертификации устройств беспроводной связи WPA, связанная с использованием криптографических алгоритмов, содержащих дефекты, позволяющая нарушителю осуществить установку и запуск приложений или получить доступ к конфиденциальным данным
EPSS
4.3 Medium
CVSS2
3.7 Low
CVSS3