CVE-2015-4141

What it actually does

The WPS UPnP implementation in hostapd (AP mode) and wpa_supplicant (external registrar mode) performs insufficient validation on chunk length values, allowing a negative length to trigger an out-of-bounds read or heap-based buffer overflow that crashes the process.

Why it matters to the business

Wireless authentication and provisioning services using WPS become unavailable after the crash, interrupting network access for users and devices until the affected service is restarted.

How an attack unfolds

An attacker on the local network sends a specially crafted UPnP WPS message containing a negative chunk length value to the vulnerable hostapd or wpa_supplicant instance; the malformed length causes an out-of-bounds memory access that terminates the process.

How to fix it

Upgrade wpa_supplicant and hostapd to a version newer than 2.4 that contains the upstream fix for the chunk-length validation flaw; if an upgrade is not immediately possible, disable WPS UPnP functionality until patched versions can be deployed.

How to confirm the fix worked

Verify installed package versions are newer than 2.4; attempt to reproduce the crash with a test packet containing a negative chunk length and confirm the process no longer terminates.

Typical attack path

1. Identify a target running hostapd or wpa_supplicant with WPS UPnP enabled
2. Craft a UPnP packet with a negative chunk length field
3. Send the packet to the UPnP listening port
4. Observe process crash and denial of service

How to detect it

Review hostapd and wpa_supplicant logs for segmentation faults or abrupt terminations during WPS UPnP processing; correlate with network traffic containing unusual UPnP chunk lengths around the time of the crash.

What your security team should do

• Prioritize upgrade of all hostapd and wpa_supplicant instances to a fixed release
• Temporarily disable WPS UPnP where upgrades cannot be applied quickly
• Monitor service availability and restart scripts for affected wireless components