Bug 1699164 (CVE-2019-9497) - CVE-2019-9497 wpa_supplicant: EAP-pwd server not checking for reflection attack
Summary: CVE-2019-9497 wpa_supplicant: EAP-pwd server not checking for reflection attack
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-9497
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20190410,repor...
Depends On: 1699165 1699166
Blocks: 1687612
TreeView+ depends on / blocked
 
Reported: 2019-04-12 00:04 UTC by Laura Pardo
Modified: 2019-06-10 10:53 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-10 10:53:58 UTC


Attachments (Terms of Use)

Description Laura Pardo 2019-04-12 00:04:09 UTC
A reflection attack is possible against the EAP-pwd server since the hostapd EAP server did not verify that the EAP-pwd-Commit contains scalar/element values that differ from the ones the server sent out itself. This allows the attacker to complete EAP-pwd authentication without knowing the password, but this does not result in the attacker being able to derive the session key (MSK), i.e., the attacker would not be able to complete the following key exchange (e.g., 4-way handshake in RSN/WPA).


References:
https://wpa3.mathyvanhoef.com/
https://w1.fi/security/2019-4/eap-pwd-missing-commit-validation.txt

Upstream Patch:
https://w1.fi/cgit/hostap/commit/?id=d63edfa90243e9a7de6ae5c275032f2cc79fef95

Comment 1 Laura Pardo 2019-04-12 00:04:30 UTC
Created hostapd tracking bugs for this issue:

Affects: epel-all [bug 1699166]
Affects: fedora-all [bug 1699165]

Comment 3 Riccardo Schirone 2019-04-12 14:46:09 UTC
Statement:

This issue did not affect the versions of wpa_supplicant as shipped with Red Hat Enterprise Linux 5, 6 as they did not include support for EAP-pwd.

This issue did not affect the versions of wpa_supplicant as shipped with Red Hat Enterprise Linux 7 as they are not compiled with EAP-pwd enabled. In particular, the CONFIG_EAP_PWD=y option is not set at compile time.

Comment 5 Laura Pardo 2019-04-12 20:32:11 UTC
Acknowledgments:

Name: Mathy Vanhoef (NYUAD), Eyal Ronen (Tel Aviv University & KU Leuven)

Comment 9 Fedora Update System 2019-04-23 18:49:19 UTC
hostapd-2.7-2.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2019-04-23 20:14:00 UTC
hostapd-2.7-2.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.