CVE-2022-23303 is a critical side-channel vulnerability affecting the SAE implementations in hostapd and wpa_supplicant before version 2.10, impacting Fedora and w1.fi products. This flaw, stemming from an incomplete fix for CVE-2019-9494, allows attackers to exploit cache access patterns. With a CVSS score of 9.8 (Critical), it presents a network-based attack vector with low complexity, potentially leading to high confidentiality, integrity, and availability impacts. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness and potential future interest.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.10CPE matchmatch criteria | cpe:2.3:a:w1.fi:hostapd:*:*:*:*:*:*:*:* | ||
< 2.10CPE matchmatch criteria | cpe:2.3:a:w1.fi:wpa_supplicant:*:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
HP ThinPro 8.1 SP7 Security Updates
Jun 3, 2025HP ThinPro 8.1 SP7 Security Updates
Jun 3, 2025wpa_supplicant: SAE side channel attacks as a result of cache access patterns
Jan 17, 2022The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
Jan 11, 2022