CVE-2020-24588
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.
02 / AFFECTED SOFTWARE
Affected packages
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
13 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.
05 / REFERENCES
Further evidence
- https://source.android.com/security/bulletin/2021-10-01
- https://source.codeaurora.org/quic/la/kernel/msm-4.14/commit/?id=aed8f80bd041daa066d66e91ad34dc053227bf57
- https://source.codeaurora.org/quic/la/kernel/msm-5.4/commit/?id=b2c81339a9c4041c03a9b3f023fbd50627d7b69a
- https://source.codeaurora.org/quic/le/kernel/msm-4.19/commit/?id=669896525ec2f1c0e0f7f644c65f4997cbc2398b
- https://source.codeaurora.org/quic/le/platform/vendor/qcom-opensource/wlan/prima/commit/?id=92d43ef6f275d90c352cc73e6cc1eb1db9eda9c3
- https://source.codeaurora.org/quic/qsdk/oss/wigig-utils/commit/?id=28ee8b8cd94976d19b27b1f7f62283ac190de47d
- https://source.codeaurora.org/quic/qsdk/oss/wigig-utils/commit/?id=47740835afcea2c564589dd708d69271f482cfb5
- http://www.openwall.com/lists/oss-security/2021/05/11/12
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
- https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00002.html
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
- https://www.fragattacks.com
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html