CVE-2019-10064
Hostapd Insufficient Entropy
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.
hostapd versiones anteriores a 2.6, en el modo EAP, hace llamadas hacia las funciones de biblioteca estándar rand() y random() sin ninguna llamada srand() o srandom() precedente, lo que resulta en un uso inapropiado de valores determinísticos. Esto fue corregido en conjunto con CVE-2016-10743.
Hostapd versions prior to 2.6 were not seeding PRNGs. This vulnerability has been fixed silently around 2016, but never attributed a CVE number, leading to many distributions and IoT devices still shipping this version of the software. In addition, it has been discovered that the Extensible Authentication Protocol (EAP) mode, which offers a protection against flooding attacks, also uses predictable PRNGs.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-26 CVE Reserved
- 2020-02-28 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-331: Insufficient Entropy
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2020/02/27/2 | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2020/03/msg00010.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| http://packetstormsecurity.com/files/156573/Hostapd-Insufficient-Entropy.html | 2024-08-04 | |
| http://seclists.org/fulldisclosure/2020/Feb/26 | 2024-08-04 | |
| http://www.openwall.com/lists/oss-security/2020/02/27/1 | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://w1.fi/cgit/hostap/commit/?id=98a516eae8260e6fd5c48ddecf8d006285da7389 | 2022-01-01 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| W1.fi Search vendor "W1.fi" | Hostapd Search vendor "W1.fi" for product "Hostapd" | < 2.6 Search vendor "W1.fi" for product "Hostapd" and version " < 2.6" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||