CVE-2022-37660
📋 TL;DR
CVE-2022-37660 is a cryptographic vulnerability in hostapd's PKEX implementation where the PKEX code remains active after successful association. This allows attackers who previously observed PKEX exchanges to passively intercept and subvert future bootstrapping attempts, potentially compromising Wi-Fi security. Affected systems include any device running hostapd 2.10 or earlier for Wi-Fi access point functionality.
💻 Affected Systems
- hostapd
📦 What is this software?
Hostapd by W1.fi
⚠️ Risk & Real-World Impact
Worst Case
Attackers can decrypt Wi-Fi communications, perform man-in-the-middle attacks, and compromise network security by subverting PKEX associations.
Likely Case
Targeted attacks against specific networks where attackers have previously observed PKEX exchanges, leading to compromised Wi-Fi security.
If Mitigated
Limited impact if PKEX is not used or if networks implement additional security controls like certificate-based authentication.
🎯 Exploit Status
Exploitation requires attackers to have previously observed PKEX exchanges and understand cryptographic implementation details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in hostapd commit 15af83cf1846870873a011ed4d714732f01cd2e4 and later versions
Vendor Advisory: https://w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4
Restart Required: Yes
Instructions:
1. Update hostapd to version with commit 15af83cf1846870873a011ed4d714732f01cd2e4 or later. 2. Restart hostapd service. 3. Verify PKEX functionality is properly terminated after successful association.
🔧 Temporary Workarounds
Disable PKEX
linuxDisable Public Key Exchange functionality if not required for your deployment
# Edit hostapd configuration file
# Remove or comment out PKEX-related configuration lines
# Restart hostapd: systemctl restart hostapd
🧯 If You Can't Patch
- Disable PKEX functionality in hostapd configuration
- Implement network segmentation to isolate Wi-Fi networks from critical systems
🔍 How to Verify
Check if Vulnerable:
Check hostapd version: hostapd -v. If version is 2.10 or earlier and PKEX is enabled, system is vulnerable.Check Version:
hostapd -vVerify Fix Applied:
Verify hostapd version includes commit 15af83cf1846870873a011ed4d714732f01cd2e4 and test PKEX functionality to ensure proper termination after association.📡 Detection & Monitoring
Log Indicators:
- Multiple PKEX association attempts
- Unusual PKEX-related errors in hostapd logs
Network Indicators:
- Suspicious PKEX traffic patterns
- Unexpected cryptographic handshake failures
SIEM Query:
hostapd_logs AND (PKEX OR "public key exchange") AND (error OR failure OR multiple_attempts)