The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade hostapdUpgrade wpa_supplicant | Mar 26, 2024 | Jan 17, 2022 |
| Debian | — | Upgrade wpa | Jul 30, 2024 | Jan 17, 2022 |
| Gentoo Linux | — | Upgrade net-wireless/hostapd.Upgrade net-wireless/wpa_supplicant. | Oct 2, 2023 | Jan 17, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade wpa_supplicant | May 25, 2022 | Jan 17, 2022 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 17, 2022 |
| Suse | — | Upgrade wpa_supplicant-guiUpgrade wpa_supplicant | Feb 19, 2022 | Jan 17, 2022 |
| Ubuntu | — | Upgrade hostapdUpgrade wpasupplicant | Mar 4, 2025 | Jan 17, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 17, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub