CVE-2022-23303: Critical severity w1.fi hostapd vulnerability
Last updated 4 March 2025
Other sources
The implementations of SAE in hostapd before 2.10 and wpasupplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wpato a version that resolves this vulnerability.Fixed in 2:2.10-12+deb12u2Fixed in 2:2.10-22 - Upgrade
Upgrade
hostapdto a version that resolves this vulnerability.Fixed in 2.10 - Upgrade
Upgrade
wpa_supplicantto a version that resolves this vulnerability.Fixed in 2.10
Event History
Frequently Asked Questions
What is CVE-2022-23303?
CVE-2022-23303 is a vulnerability in the implementations of SAE in hostapd and wpa_supplicant, which are used for Wi-Fi access point management and Wi-Fi client management, respectively.
What is the severity of CVE-2022-23303?
CVE-2022-23303 has a severity rating of critical with a score of 9.8.
Which software versions are affected by CVE-2022-23303?
Versions before 2.10 of hostapd and wpa_supplicant are affected by CVE-2022-23303.
What is the impact of CVE-2022-23303?
CVE-2022-23303 allows attackers to perform side channel attacks due to cache access patterns, potentially compromising the security of the Wi-Fi connections.
How can I fix CVE-2022-23303?
To fix CVE-2022-23303, upgrade to hostapd and wpa_supplicant versions 2.10 or above.