CVE-2015-4145 in hostapd
Summary
by MITRE
The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/21/2022
The vulnerability identified as CVE-2015-4145 affects the EAP-pwd authentication implementation within hostapd and wpa_supplicant versions 1.0 through 2.4. This flaw resides in the Extensible Authentication Protocol over Password (EAP-pwd) protocol handler which is designed to provide secure password-based authentication for wireless networks. The vulnerability specifically impacts the server and peer implementations of EAP-pwd, creating a critical security gap that can be exploited by remote attackers to disrupt network services. The issue stems from inadequate message processing logic that fails to properly track and validate message fragments, leading to potential memory allocation issues and service disruption.
The technical flaw manifests in the absence of proper duplicate fragment detection mechanisms within the EAP-pwd implementation. When processing EAP-pwd messages, the software does not maintain adequate state tracking to identify when a fragment is already being processed or has been previously handled. This lack of validation allows attackers to craft specially formatted messages that contain duplicate or overlapping fragments, causing the authentication daemon to allocate memory resources for processing the same fragment multiple times without proper cleanup. The vulnerability operates at the protocol implementation level, specifically within the EAP-pwd message handling subsystem where fragment reassembly and processing occurs.
From an operational impact perspective, this vulnerability enables remote attackers to execute a denial of service attack against wireless access points and authentication servers that utilize affected versions of hostapd or wpa_supplicant. The attack results in memory leaks that gradually consume system resources, eventually leading to service unavailability and network disruption. The memory consumption occurs because each crafted message fragment triggers new memory allocations without corresponding deallocations, creating a gradual degradation of system performance that can ultimately render the wireless authentication service unusable. This affects enterprise wireless networks, public Wi-Fi deployments, and any infrastructure relying on EAP-pwd authentication for secure wireless access.
The vulnerability maps to CWE-400, which describes "Uncontrolled Resource Consumption" in the Common Weakness Enumeration catalog, specifically highlighting the improper handling of resource allocation and deallocation. From an ATT&CK framework perspective, this vulnerability aligns with T1499.004, "Network Denial of Service," and T1595.001, "Network Target Reconnaissance," as attackers can exploit it to disrupt services while potentially gathering information about vulnerable systems. The attack requires minimal privileges and can be executed remotely, making it particularly dangerous in environments where wireless authentication is critical. Organizations should prioritize patching affected systems to address this vulnerability, as it represents a significant risk to wireless network availability and can be exploited by adversaries without requiring specialized access or credentials.
Mitigation strategies should focus on immediate patch deployment for all affected hostapd and wpa_supplicant installations, ensuring that versions 2.5 and later are implemented where the fragment processing logic has been corrected. Network administrators should also implement monitoring for unusual memory consumption patterns in wireless authentication services and establish network segmentation to limit the impact of potential exploitation. Additionally, organizations should consider implementing intrusion detection systems that can identify and alert on anomalous EAP-pwd message patterns that may indicate exploitation attempts, providing early warning capabilities for potential attacks targeting this vulnerability.