CVE-2022-23303 Information disclosure in n/a
Side-channel attacks in SAE implementations allow attackers to potentially recover sensitive information via cache access patterns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23303?
CVE-2022-23303 is a critical vulnerability in Fedoraproject Fedora, published on 17 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
Weakness: CWE-203
Which versions are affected by CVE-2022-23303?
It affects 3 products.
Linux distribution packages (3)
wpa_supplicant Red Hat:enterprise_linux:9::baseos | All versions | 1:2.10-2.el9 |
wpa_supplicant-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 1:2.10-2.el9 |
wpa_supplicant-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 1:2.10-2.el9 |
Products include Fedoraproject Fedora, W1.fi Hostapd, W1.fi Wpa Supplicant.
How do I fix CVE-2022-23303?
Upgrade to a fixed version.
Is CVE-2022-23303 being exploited?
There is no known exploitation of CVE-2022-23303 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2022-23303, AZL-7747, DEBIAN-CVE-2022-23303, GHSA-8v55-rm6p-87p5, MGASA-2022-0025, RHBA-2022:3991 and 1 more.