CVE-2022-37660

Publication date 11 February 2025

Last updated 30 May 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.5 · Medium

Score breakdown

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.

Read the notes from the security team

Status

Package Ubuntu Release Status
wpa 24.10 oracular
Fixed 2:2.10-22ubuntu0.1
24.04 LTS noble
Fixed 2:2.10-21ubuntu0.2
22.04 LTS jammy
Fixed 2:2.10-6ubuntu2.2
20.04 LTS focal
Fixed 2:2.9-1ubuntu4.6
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected
14.04 LTS trusty
Not affected

Notes

hlibk

On bionic and earlier, WPA3 support is not present.

Severity score breakdown

Parameter Value
Base score 6.5 · Medium
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N