Vulnerability · Published Feb 26, 2021 · Assigned by mitre
CVE-2021-27803
High 7.5
In plain English
A high-severity security flaw in the wpa_supplicant package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.2%top 31.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | wpa_supplicant | 2.9-r12 | ALPINE-CVE-2021-27803 |
| Alpine:v3.21 | wpa_supplicant | 2.9-r12 | ALPINE-CVE-2021-27803 |
| Alpine:v3.22 | wpa_supplicant | 2.9-r12 | ALPINE-CVE-2021-27803 |
| Alpine:v3.23 | wpa_supplicant | 2.9-r12 | ALPINE-CVE-2021-27803 |
| Alpine:v3.24 | wpa_supplicant | 2.9-r12 | ALPINE-CVE-2021-27803 |
| Debian:12 | wpa | 2:2.9.0-21 | DEBIAN-CVE-2021-27803 |
| Debian:13 | wpa | 2:2.9.0-21 | DEBIAN-CVE-2021-27803 |
| Debian:14 | wpa | 2:2.9.0-21 | DEBIAN-CVE-2021-27803 |
Affected products (as reported)
References
- https://www.openwall.com/lists/oss-security/2021/02/25/3 x_refsource_MISC
- https://w1.fi/security/2021-1/wpa_supplicant-p2p-provision-discovery-processing-vulnerability.txt x_refsource_MISC
- https://w1.fi/security/2021-1/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch x_refsource_MISC
- [oss-security] 20210227 Re: wpa_supplicant P2P provision discovery processing vulnerability mailing-list, x_refsource_MLIST
- FEDORA-2021-3430f96019 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20210302 [SECURITY] [DLA 2581-1] wpa security update mailing-list, x_refsource_MLIST
- FEDORA-2021-99cad2b81f vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-9b00febe54 vendor-advisory, x_refsource_FEDORA
- DSA-4898 vendor-advisory, x_refsource_DEBIAN