CVE-2019-11555 : What You Need to Know

A vulnerability has been identified in the EAP-pwd implementation in hostapd (EAP server) versions prior to 2.8 and wpa_supplicant (EAP peer) versions prior to 2.8. This vulnerability could lead to a denial of service due to a NULL pointer dereference.

Understanding CVE-2019-11555

This CVE pertains to a vulnerability in the EAP-pwd implementation in hostapd and wpa_supplicant versions prior to 2.8.

What is CVE-2019-11555?

The vulnerability arises from improper validation of the fragmentation reassembly state, allowing an unexpected fragment to trigger a NULL pointer dereference, potentially leading to a denial of service.

The Impact of CVE-2019-11555

Exploiting this vulnerability could result in the termination of the process due to a NULL pointer dereference, causing a denial of service.

Technical Details of CVE-2019-11555

This section provides more technical insights into the vulnerability.

Vulnerability Description

The EAP-pwd implementation in hostapd and wpa_supplicant fails to validate fragmentation reassembly state properly, potentially leading to a NULL pointer dereference and denial of service. The affected files are eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.

Affected Systems and Versions

hostapd (EAP server) versions prior to 2.8
wpa_supplicant (EAP peer) versions prior to 2.8

Exploitation Mechanism

The vulnerability occurs when an unexpected fragment is received, triggering improper validation of the fragmentation reassembly state and leading to a NULL pointer dereference.

Mitigation and Prevention

Protecting systems from CVE-2019-11555 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update hostapd and wpa_supplicant to versions 2.8 or newer to mitigate the vulnerability.
Monitor vendor advisories and apply patches promptly.

Long-Term Security Practices

Regularly update software and firmware to address security vulnerabilities.
Implement network segmentation and access controls to limit the impact of potential attacks.

Patching and Updates

Apply patches provided by the respective vendors to address the vulnerability in hostapd and wpa_supplicant.