CVE-2019-9495 : What You Need to Know

A vulnerability in the implementations of EAP-PWD in hostapd and wpa_supplicant allows for side-channel attacks due to cache access patterns.

Understanding CVE-2019-9495

This CVE identifies a security issue in hostapd and wpa_supplicant related to EAP-PWD support.

What is CVE-2019-9495?

The vulnerability arises from cache access patterns in the EAP-PWD implementation in hostapd and wpa_supplicant, enabling side-channel attacks. It affects all versions supporting EAP-PWD.

The Impact of CVE-2019-9495

Successful exploitation requires the ability to install and run applications, potentially leading to the exposure of memory access patterns in a shared cache.
Weak passwords are at risk of being cracked through this vulnerability.
Versions 2.7 and newer of hostapd/wpa_supplicant are immune to the timing attack mentioned in CVE-2019-9494.

Technical Details of CVE-2019-9495

This section delves into the specifics of the vulnerability.

Vulnerability Description

The vulnerability allows for side-channel attacks due to cache access patterns in the EAP-PWD implementation in hostapd and wpa_supplicant.

Affected Systems and Versions

Products: hostapd with EAP-pwd support, wpa_supplicant with EAP-pwd support
Vendor: Wi-Fi Alliance
Versions affected: <= 2.7

Exploitation Mechanism

The vulnerability can be exploited through side-channel attacks leveraging cache access patterns in the EAP-PWD implementation.

Mitigation and Prevention

Protecting systems from CVE-2019-9495 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update hostapd and wpa_supplicant to versions 2.7 or newer to mitigate the vulnerability.
Monitor for security advisories and patches from the vendor.

Long-Term Security Practices

Implement strong password policies to reduce the risk of password cracking.
Regularly update and patch software to address security vulnerabilities.
Employ network segmentation and access controls to limit exposure to potential attacks.
Conduct regular security assessments and audits to identify and remediate vulnerabilities.

Patching and Updates

Regularly check for updates and patches from Wi-Fi Alliance for hostapd and wpa_supplicant to address CVE-2019-9495.