VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 17, 2022· Updated Nov 3, 2025

CVE-2022-23304

CVE-2022-23304

Description

Incomplete fix for CVE-2019-9495 leaves hostapd and wpa_supplicant before version 2.10 vulnerable to side-channel attacks via cache access patterns.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Incomplete fix for CVE-2019-9495 leaves hostapd and wpa_supplicant before version 2.10 vulnerable to side-channel attacks via cache access patterns.

Vulnerability

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9495 [3].

Exploitation

An attacker with network proximity and the ability to observe timing or cache behavior can exploit the side-channel. The attack requires the ability to participate in EAP-pwd handshake exchanges. The incomplete fix left residual data-dependent memory access patterns that leak information [3].

Impact

Successful exploitation may allow an attacker to recover the password used in the EAP-pwd protocol, leading to unauthorized network access. The impact is confidentiality disclosure of the password [3].

Mitigation

Upgrade to hostapd and wpa_supplicant version 2.10 or later. Gentoo advisory recommends updating to >=net-wireless/wpa_supplicant-2.10 and >=net-wireless/hostapd-2.10 [2]. No workaround is available. Patches are provided by the vendor [3].

References
  1. Multiple Vulnerabilities (GLSA 202309-16) — Gentoo security
  2. Index of /security/2022-1

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

41

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.