CVE-2019-9494
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacks
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
Las implementaciones SAE en hostapd y wpa_supplicant son vulnerables a los ataques de canal lateral (side channel) como resultado de diferencias de tiempo observables y patrones de acceso a la caché. Un atacante puede conseguir información filtrada de un ataque de canal lateral (side channel) que pueda ser usado para la recuperación completa de la contraseña. Tanto hostapd con soporte SAE como wpa_supplicant con soporte SAE antes e incluyendo la versión 2.7 están afectados.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-01 CVE Reserved
- 2019-04-17 CVE Published
- 2024-08-04 CVE Updated
- 2024-10-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-203: Observable Discrepancy
- CWE-208: Observable Timing Discrepancy
- CWE-524: Use of Cache Containing Sensitive Information
CAPEC
References (9)
URL | Tag | Source |
---|---|---|
http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html | Third Party Advisory | |
https://seclists.org/bugtraq/2019/May/40 | Mailing List | |
https://www.synology.com/security/advisory/Synology_SA_19_16 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://w1.fi/security/2019-1 | 2023-11-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
W1.fi Search vendor "W1.fi" | Hostapd Search vendor "W1.fi" for product "Hostapd" | <= 2.7 Search vendor "W1.fi" for product "Hostapd" and version " <= 2.7" | - |
Affected
| ||||||
W1.fi Search vendor "W1.fi" | WPA Supplicant Search vendor "W1.fi" for product "WPA Supplicant" | <= 2.7 Search vendor "W1.fi" for product "WPA Supplicant" and version " <= 2.7" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 28 Search vendor "Fedoraproject" for product "Fedora" and version "28" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 29 Search vendor "Fedoraproject" for product "Fedora" and version "29" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 30 Search vendor "Fedoraproject" for product "Fedora" and version "30" | - |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Backports Sle Search vendor "Opensuse" for product "Backports Sle" | 15.0 Search vendor "Opensuse" for product "Backports Sle" and version "15.0" | - |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Backports Sle Search vendor "Opensuse" for product "Backports Sle" | 15.0 Search vendor "Opensuse" for product "Backports Sle" and version "15.0" | sp1 |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.1 Search vendor "Opensuse" for product "Leap" and version "15.1" | - |
Affected
| ||||||
Synology Search vendor "Synology" | Radius Server Search vendor "Synology" for product "Radius Server" | 3.0 Search vendor "Synology" for product "Radius Server" and version "3.0" | - |
Affected
| ||||||
Synology Search vendor "Synology" | Router Manager Search vendor "Synology" for product "Router Manager" | < 1.2.3-8087 Search vendor "Synology" for product "Router Manager" and version " < 1.2.3-8087" | - |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | - |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | p2 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | p3 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | p4 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | p5 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | p6 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | p7 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | p8 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | p9 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.2 Search vendor "Freebsd" for product "Freebsd" and version "11.2" | rc3 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0" | - |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0" | p1 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0" | p2 |
Affected
| ||||||
Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.0 Search vendor "Freebsd" for product "Freebsd" and version "12.0" | p3 |
Affected
|