CVE-2022-37660: Medium severity Hostapd Hostapd vulnerability
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If PKEX is not required, disable PKEX in hostapd configurations to prevent attackers from passively subverting a future bootstrapping via reused encrypting element Qi after prior bootstrap activity.
hostapd PKEX = disabled (if not required) - Compensating control
Update hostapd to a version where the PKEX code does not remain active after a successful PKEX association (the issue affects hostapd 2.10 and earlier, so deploy a fixed release).
Event History
Frequently Asked Questions
What is the severity of CVE-2022-37660?
CVE-2022-37660 has a medium severity level as it allows attackers to potentially subvert secure bootstrapping processes.
How do I fix CVE-2022-37660?
To fix CVE-2022-37660, upgrade hostapd to version 2.11 or later which addresses this vulnerability.
How does CVE-2022-37660 impact hostapd users?
CVE-2022-37660 allows an attacker to reuse previously bootstrapped public keys, compromising security in communications.
Is CVE-2022-37660 still a concern if I use a later version of hostapd?
No, CVE-2022-37660 is not a concern for users who upgrade to hostapd version 2.11 or newer.
What type of attacks can CVE-2022-37660 facilitate?
CVE-2022-37660 can facilitate man-in-the-middle attacks by enabling attackers to subvert secure PKEX associations.