An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 4.5%
exploitation probability
4.5%top 9% of all CVEs
observed exploitation
nono source reports it
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
Affected products
Wi-Fi Alliance · hostapd with SAE supportWi-Fi Alliance · wpa_supplicant with SAE supportReferences
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.htmlhttp://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVMJOFEYBGXZLFF5IOLW67SSOPKFEJP3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDOZGR3T7FVO5JSZWK2QPR7AOFIEJTIZ/https://seclists.org/bugtraq/2019/May/40https://security.FreeBSD.org/advisories/FreeBSD-SA-19:03.wpa.aschttps://w1.fi/security/2019-3/https://www.synology.com/security/advisory/Synology_SA_19_16