Side-Channel Vulnerability in Hostapd and WPA Supplicant by the Vendor

CVE-2019-13377

What is CVE-2019-13377?

The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant versions 2.x through 2.8 exhibit vulnerabilities that can be exploited through side-channel attacks. These vulnerabilities stem from observable timing differences and cache access patterns when using Brainpool curves. An attacker can take advantage of these weaknesses to obtain sensitive information, potentially leading to full password recovery.

References