CVE-2015-5316 — NULL Pointer Dereference in WPA Supplicant

CWE-476 — NULL Pointer Dereference9 documents8 sources
Severity
5.9MEDIUMNVD
EPSS
1.5%
top 18.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
W1.fi WPA SupplicantDebian Linux
Timeline
PublishedFeb 21
Latest updateMay 14

Description

The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an EAP-pwd Confirm message followed by the Identity exchange.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages1 packages

▶NVDw1.fi/wpa_supplicant2.0 — 2.6

Also affects: Debian Linux 8.0

Patches

Patch: w1.fi ↗Patch: www.openwall.com ↗Patch: w1.fi ↗

🔴Vulnerability Details

4
GHSA
GHSA-6mw8-f5p4-3j6f: The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd↗2022-05-14
▶
OSV
CVE-2015-5316: The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd↗2018-02-21
▶
CVEList
CVE-2015-5316: The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd↗2018-02-21
▶
OSV
wpa vulnerabilities↗2015-11-10
▶

📋Vendor Advisories

3
Red Hat
wpa_supplicant: EAP-pwd peer error path failure on unexpected Confirm message↗2015-11-10
▶
Ubuntu
wpa_supplicant and hostapd vulnerabilities↗2015-11-10
▶
Debian
CVE-2015-5316: wpa - The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_suppl...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-5316 wpa_supplicant: EAP-pwd peer error path failure on unexpected Confirm message↗2015-11-04
▶
CVE-2015-5316 — NULL Pointer Dereference | cvebase