CVE-2021-30004

Vulnerability

In wpa_supplicant and hostapd version 2.9, the functions handling AlgorithmIdentifier parameters in tls/pkcs1.c and tls/x509v3.c are improperly implemented, allowing attackers to forge certificates or signatures. This vulnerability affects both software packages when used as a WPA supplicant or access point daemon.

Exploitation

An attacker with network access to a device running the affected software can craft malicious TLS certificates or X.509 signatures that bypass validation. The exact attack vector is not detailed, but the issue is related to the parsing of AlgorithmIdentifier structures.

Impact

Successful exploitation could allow an attacker to perform forging attacks, potentially leading to authentication bypass, man-in-the-middle attacks, or, in worst cases, arbitrary code execution as cited in the advisory [1].

Mitigation

Upgrade to wpa_supplicant version 2.10 or later, and hostapd version 2.10 or later. No workaround is available at this time, as stated in the Gentoo security advisory [1].