CVE-2019-5062 in Hostapd
Summary
by MITRE
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resulting in a denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/11/2024
The vulnerability described in CVE-2019-5062 represents a critical denial-of-service weakness within the hostapd wireless access point implementation that specifically targets 802.11w security protocols. This flaw exists in hostapd version 2.6 and affects wireless networks that implement protected management frames through 802.11w standards. The vulnerability stems from improper handling of security state transitions during client association processes, creating a scenario where malicious actors can exploit the protocol implementation to disrupt legitimate network operations.
The technical exploitation mechanism involves an attacker crafting and transmitting specific wireless frames that simulate an incomplete new association process. This manipulation targets the 802.11w security state machine within hostapd, causing it to incorrectly handle the security session establishment for clients that have already authenticated using protected management frames. The flaw specifically manifests when hostapd processes these malformed association attempts while managing existing 802.11w sessions, leading to an unintended deauthentication of connected stations. This behavior violates the expected protocol flow and demonstrates a failure in state management within the wireless access point implementation.
From an operational impact perspective, this vulnerability enables attackers to perform targeted denial-of-service attacks against wireless networks that rely on 802.11w protection. The attack can selectively target specific client stations that have established 802.11w sessions, forcing them to disconnect from the network and requiring re-authentication. This disruption affects network availability and can impact services dependent on wireless connectivity, particularly in enterprise environments where 802.11w is implemented for enhanced security. The vulnerability is particularly concerning because it exploits legitimate security features rather than bypassing them, making detection more challenging and potentially allowing attackers to remain undetected while causing service disruption.
The vulnerability aligns with CWE-362, which addresses race conditions in security-critical operations, and demonstrates characteristics of CWE-284, related to improper access control in protocol implementations. From an ATT&CK framework perspective, this vulnerability maps to T1499.001, covering network denial of service attacks, and potentially T1059.007 for command and control through wireless protocols. The attack vector requires proximity to the wireless network and the ability to transmit 802.11 frames, making it a physical or local network-based threat. Mitigation strategies should include upgrading to hostapd versions that address this specific state handling issue, implementing additional wireless intrusion detection systems, and potentially configuring wireless networks to disable 802.11w if the risk of exploitation outweighs the security benefits. Network administrators should also consider monitoring for unusual deauthentication patterns that might indicate exploitation attempts and maintain regular security updates for wireless infrastructure components.