FragAttacks – Allowing adversaries to steal data by intercepting vulnerable network traffic from Wi-Fi devices

For a detailed advisory, download the pdf file here.

Multiple vulnerabilities aka FragAttacks(fragmentation and aggregation attacks) have been found in Wi-Fi devices that makes most of the smartphones, servers, and operating systems susceptible to these. These vulnerabilities not only affect the latest Wi-Fi security protocol WPA3 but also affects the oldest protocol namely WEP which was released in 1997. Researchers have found 3 different types of flaws which includes Design Flaws( CVE-2020-24588, CVE-2020-24587, CVE-2020-24586), Implementation vulnerabilities that allow the trivial injection (CVE-2020-26145, CVE-2020-26144, CVE-2020-26140, CVE-2020-26143) and other implementation flaws (CVE-2020-26139,CVE-2020-26146,CVE-2020-26147,CVE-2020-26142,CVE-2020-26141)

Vulnerability Details

For details, please refer to the pdf version of the advisory here

Patch Link

https://github.com/vanhoefm/fragattacks/blob/master/ADVISORIES.md

References

• https://github.com/vanhoefm/fragattacks
• https://www.fragattacks.com/
• https://www.openwall.com/lists/oss-security/2021/05/11/12
• https://latesthackingnews.com/2021/05/16/fragattacks-newly-discovered-vulnerabilities-affect-wifi-and-iot-devices/