^{CVE-2020-24588:}Wi-Fi Protected Access (WPA, WPA2, WPA3) and WEP vulnerability allowing arbitrary packet injection due to unauthenticated A-MSDU flag in QoS header field.

Overview

CVE-2020-24588 is a design flaw in the IEEE 802.11 standard that affects virtually all Wi-Fi devices. The vulnerability stems from the lack of authentication for the A-MSDU flag in the QoS header field. This oversight allows attackers within radio range to inject arbitrary packets into protected Wi-Fi networks by manipulating this flag. Since support for non-SSP A-MSDU frames is mandatory for 802.11n compliance, most modern Wi-Fi devices are vulnerable.

The attack works because when the A-MSDU flag is set, receivers will process the frame's data as if it contains multiple packets aggregated together. By manipulating this flag, an attacker can make a receiver interpret regular data as network packets, effectively bypassing the encryption protection. This vulnerability is particularly concerning because it affects the Wi-Fi standard itself rather than specific implementations, making it widespread across vendors and devices.

Remediation

1. Update all Wi-Fi device firmware and drivers to the latest versions that include patches for FragAttacks vulnerabilities.
2. Apply vendor-specific patches as they become available for routers, access points, client devices, and IoT devices.
3. For network administrators:
   • Implement additional network segmentation to limit potential damage from injected packets.
   • Use VPNs for sensitive communications to add an extra layer of encryption.
   • Enable HTTPS on all websites and services to protect against potential packet injection.
   • Consider implementing intrusion detection systems that can identify unusual traffic patterns.
4. For device manufacturers:
   • Implement proper authentication of the A-MSDU flag in Wi-Fi implementations.
   • Follow security best practices for frame aggregation and fragmentation handling.

References

1. FragAttacks official website: https://www.fragattacks.com
2. FragAttacks technical summary: https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
3. Cisco Security Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu
4. Intel Security Advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html
5. Arista Security Advisory: https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
6. Siemens Security Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
7. Debian Security Updates:
   • https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
   • https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
   • https://lists.debian.org/debian-lts-announce/2023/04/msg00002.html
8. OSS-Security Mailing List: http://www.openwall.com/lists/oss-security/2021/05/11/12