Wi-Fi client vulnerability could expose Android, Linux, BSD, other systems to attacks

A flaw in the widely used wpa_supplicant wireless client can lead remote code execution

A serious flaw in a component that's used to authenticate clients on Wi-Fi networks could expose Android, Linux, BSD, and possibly Windows and Mac OS X systems to attacks.

The vulnerability is in wpa_supplicant, an open-source software implementation of the IEEE 802.11i specifications for wireless clients.

The component is cross-platform and is used to control WPA and WPA2 wireless connections on Android, Linux and BSD systems. It can also be used by some third-party wireless software on Mac OS X and Windows, but these operating systems have their own built-in supplicant implementations that are used by default.

The vulnerability stems from how wpa_supplicant parses SSID (Service Set Identifier) information from wireless network frames when the CONFIG_P2P option is enabled. If exploited, the flaw can allow attackers to crash the client (denial of service), read contents from the process's memory or inject arbitrary data into its memory, which could result in arbitrary code execution.

All versions of wpa_supplicant from 1.0 to 2.4 are vulnerable. A patch was released Wednesday and operating systems are expected to update their packages.

"The vulnerability is easiest to exploit while the device has started an active P2P operation (e.g., has ongoing P2P_FIND or P2P_LISTEN control interface command in progress)," said Jouni Malinen, maintainer of wpa_supplicant, in an advisory posted on the OSS security mailing list. "However, it may be possible, though significantly more difficult, to trigger this even without any active P2P operation in progress."

The vulnerability was discovered by the hardware research group at Alibaba and was reported to the wpa_supplicant development team by the Google security team.

Users should install the security updates for wpa_supplicant when they become available for their operating systems. A mitigation in the meantime is to disable P2P for each wireless interface in the wpa_supplicant configuration file by following instructions in the advisory.

Unfortunately, wpa_supplicant is also used on embedded devices, for which patches are not as frequently released or easy to install.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags patchesonline safetysecurityAccess control and authenticationExploits / vulnerabilities

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?