CVE-2019-9496: An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpasupplicant with SAE support prior to and including version 2.7 are affected.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-9496?
CVE-2019-9496 is a vulnerability that could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode.
What is the severity of CVE-2019-9496?
The severity of CVE-2019-9496 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-9496?
All versions of hostapd with SAE support up to version 2.7 and all versions of W1.fi Wpa Supplicant up to version 2.7 are vulnerable. Also, Fedora versions 28, 29, and 30 are affected.
How can an attacker exploit CVE-2019-9496?
An attacker can force the hostapd process to terminate, potentially causing a denial-of-service condition.
Are there any references available for CVE-2019-9496?
Yes, you can find more information about CVE-2019-9496 at the following references: [1](http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html), [2](http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html), [3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/)