Jouni Malinen

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the cfg80211 component of the Linux kernel, where the management registrations locking was broken. This caused list corruption because the `cfg80211 mgmt registrations update()` function iterated the list without holding all the correct spinlocks. The problem was fixed by moving the lock to the wiphy/rdev, which trivially fixes the bug since the wdev lock is already held. This issue could allow an attacker to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant versions prior to 2.10 **Description** A vulnerability in the p2p/p2p pd.c component of wpa supplicant is related to resource release errors. Exploitation of this issue could allow a remote attacker to cause a denial of service or potentially execute arbitrary code. The attacker must be within radio range to send specially crafted Wi-Fi Direct provision discovery requests. **Recommendations** For versions prior to 2.10, update to version 2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to Wi-Fi Direct features until the update is applied.

**Name of the Vulnerable Software and Affected Versions** hostapd versions prior to 2.10 wpa supplicant versions prior to 2.10 **Description** The issue is related to a denial of service caused by mishandled source address validation, which should have been prevented by management frame protection. An attacker within the 802.11 communications range can send a crafted 802.11 frame to cause associated stations to be disconnected, requiring a reconnection to the network. This can be achieved by injecting a specially constructed unauthenticated IEEE 802.11 frame to the access point. **Recommendations** For hostapd versions prior to 2.10, update to version 2.10 or later to resolve the issue. For wpa supplicant versions prior to 2.10, update to version 2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the network to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** hostapd versions prior to 2.8 wpa supplicant versions prior to 2.8 **Description** The issue is related to the EAP-pwd implementation, which does not properly validate fragmentation reassembly state. This could lead to process termination due to a NULL pointer dereference, resulting in a denial of service. The affected components are eap server/eap server pwd.c and eap peer/eap pwd.c. **Recommendations** For hostapd versions prior to 2.8, update to version 2.8 or later to resolve the issue. For wpa supplicant versions prior to 2.8, update to version 2.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** FreeRADIUS versions 3.0 through 3.0.8 **Description** The issue in the EAP-PWD module allows remote attackers to have an unspecified impact by sending a crafted commit or confirm message. This triggers an out-of-bounds read. **Recommendations** For FreeRADIUS versions 3.0 through 3.0.8, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** FreeRADIUS versions 3.0 through 3.0.8 **Description** The issue allows remote attackers to cause a denial of service, resulting in a server crash due to a NULL pointer dereference. This can be achieved by sending a zero-length EAP-PWD packet. **Recommendations** For FreeRADIUS versions 3.0 through 3.0.8, update to a version that contains a fix for this issue to prevent remote attackers from causing a denial of service.

**Name of the Vulnerable Software and Affected Versions** FreeRADIUS versions 3.0 through 3.0.8 **Description** The issue is caused by an off-by-one error in the EAP-PWD module, which triggers a buffer overflow. **Recommendations** For FreeRADIUS versions 3.0 through 3.0.8, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant versions 2.x before 2.6 **Description** The issue is related to the WNM Sleep Mode code in wpa supplicant, which does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated. This allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service. Additionally, there is a Wi-Fi module vulnerability in the Android operating system related to the lack of protection for service data, which can allow an attacker to obtain confidential information about wireless network parameters by accessing the local physical environment. **Recommendations** For wpa supplicant versions 2.x before 2.6, update to version 2.6 or later to resolve the issue. As a temporary workaround, consider disabling the WNM Sleep Mode feature until a patch is available. Restrict access to the Wi-Fi module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant versions 2.x before 2.6 **Description** The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending an EAP-pwd Confirm message followed by the Identity exchange when EAP-pwd is enabled. This is due to a NULL pointer dereference in the `eap pwd perform confirm exchange` function. **Recommendations** For wpa supplicant versions 2.x before 2.6, update to version 2.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant versions 2.0 through 2.5 **Description** The issue concerns the `eap pwd process` function in `eap peer/eap pwd.c`, which does not validate the size of the reassembly buffer for the final fragment when EAP-pwd is enabled. This allows remote attackers to cause a denial of service by sending a large final fragment in an EAP-pwd message. **Recommendations** For wpa supplicant versions 2.0 through 2.5, update to version 2.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** hostapd versions 2.0 through 2.5 **Description** The issue is related to the `eap pwd process` function in `eap server/eap server pwd.c`, which does not validate the size of the reassembly buffer for the final fragment in EAP-pwd messages. This can be exploited by remote attackers to cause a denial of service (process termination) by sending a large final fragment in an EAP-pwd message, particularly when used with an internal EAP server or a RADIUS server with EAP-pwd enabled. **Recommendations** For hostapd versions 2.0 through 2.5, update to version 2.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant versions 1.0 through 2.4 **Description** The issue allows remote attackers to cause a denial of service, read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries. **Recommendations** For wpa supplicant versions 1.0 through 2.4, update to a version that contains a fix for this issue to prevent potential exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.13.5 **Description** The issue is related to the ieee80211 fragment function in the Linux kernel, which does not properly maintain a certain tail pointer. This allows remote attackers to obtain sensitive cleartext information by reading packets. **Recommendations** For versions prior to 3.13.5, update to version 3.13.5 or later to resolve the issue.