Fragattacks

Fragattacks

Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation

Mathy Vanhoef 박사는 802.11 표준의 집계 및 단편화 체계의 보안 취약점을 공개했습니다. 공격 대상자가 무선 범위 내에 있는 경우 취약성을 이용하여 사용자 정보나 공격 장치를 도용할 수 있습니다. 발견된 취약점 중 3가지는 표준의 설계 결함이므로 대부분 장치에 영향을 미칩니다.

 

마지막 업데이트 : 2021-11-20 KST 21:45

 

CVE : CVE-2020-24586, CVE-2020-24587, CVE-2020-24588, CVE-2020-26139 CVE-2020-26140, CVE-2020-26141, CVE-2020-26142, CVE-2020-26143, CVE-2020-26144, CVE-2020-26145, CVE-2020-26146, CVE-2020-26147

 

CVE-2020-24586 – Not clearing fragments from memory when (re)connecting to a network
CVE-2020-24587 – Reassembling fragments encrypted under different keys
CVE-2020-24588 – Accepting non-SPP A-MSDU frames
CVE-2020-26139 – Forwarding EAPOL frames even though the sender is not yet authenticated
CVE-2020-26140 – Accepting plaintext data frames in a protected network
CVE-2020-26141 – Not verifying the TKIP MIC of fragmented frames
CVE-2020-26142 – Processing fragmented frames as full frames
CVE-2020-26143 – Accepting fragmented plaintext data frames in a protected network
CVE-2020-26144 – Accepting plaintext A-MSDU frames that start with an RFC1042 header with EtherType EAPOL (in an encrypted network)
CVE-2020-26145 – Accepting plaintext broadcast fragments as full frames (in an encrypted network)
CVE-2020-26146 – Reassembling encrypted fragments with non-consecutive packet numbers
CVE-2020-26147 – Reassembling mixed encrypted/plaintext fragments

 

공식 사이트 : https://www.fragattacks.com/

연구 논문 : https://papers.mathyvanhoef.com/usenix2021.pdf

Wi-Fi Alliance : https://www.wi-fi.org/security-update-fragmentation

ICASI : https://www.icasi.org/aggregation-fragmentation-attacks-against-wifi/

 

Ruckus

https://www.commscope.com/fragattacks-commscope-ruckus-resource-center

https://support.ruckuswireless.com/fragattacks-ruckus-technical-support-response-center

11acW2, 11ax AP 패치 완료(지원 중인 전 플랫폼/버전 패치 완료)

11acW1 AP 지원 중인 SZ 플랫폼 5.2.2.0.1080 패치 완료, 기타 플랫폼/버전 TBD

11n AP 패치 제공 없음 (-> 자세한 내용은 상단 링크 참조)

 

Aruba(HPE) - ARUBA-PSA-2021-011

https://www.arubanetworks.com/support-services/security-bulletins/

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-011.txt

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-011-FAQ.pdf

지원 AP(11n, 11acW1, 11acW2, 11ax AP) 패치 완료(지원 중인 전 플랫폼/버전 패치 완료)

 

Cisco(Meraki) - cisco-sa-wifi-faf-22epcEWu

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wifi-faf-22epcEWu

일부 11n, 11acW1, 11acW2, 11ax AP 패치 완료(지원 중인 전 플랫폼/버전 패치 완료)

 

* Meraki의 경우 위 링크 참조

 

Juniper(Mist) - JSA11170

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11170

 

Arista(Mojo Networks) – Security Advisory 0063

https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63

 

Extreme Networks(Aerohive) – VN-2021-460

https://extremeportal.force.com/ExtrArticleDetail?an=000095779

 

Sierra Wireless - SWI-PSA-2021-003

https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2021-003/

 

Huawei - huawei-sn-20210513-01-fragattacks

https://www.huawei.com/en/psirt/security-notices/huawei-sn-20210513-01-fragattacks-en

 

Fortinet - FG-IR-21-071

https://www.fortiguard.com/psirt/FG-IR-21-071

 

WatchGuard - 000019148

https://techsearch.watchguard.com/KB?type=Security%20Issues&SFDCID=kA16S000000XeO7SAK&lang=en_US 

 

Cambium Networks - Advisory-2021-02

https://www.cambiumnetworks.com/security/advisory-2021-02-wi-fi-access-points/

 

Sophos

https://community.sophos.com/b/security-blog/posts/multiple-vulnerabilities-aka-fragattacks-in-wifi-specification

 

Zyxel

https://www.zyxel.com/support/Zyxel_security_advisory_for_FragAttacks_against_WiFi_products.shtml 

 

Synology – Synology-SA-21:20 FragAttacks

https://www.synology.com/en-global/security/advisory/Synology_SA_21_20

 

Netgear – PSV-2021-0014 and PSV-2021-0080

https://kb.netgear.com/000063666/Security-Advisory-for-Fragment-and-Forge-vulnerabilities-on-some-WiFi-capable-devices-PSV-2021-0014-PSV-2021-0080

 

Intel - INTEL-SA-00473

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html

 

Lenovo – LEN-57316

https://support.lenovo.com/kr/en/product_security/len-57316

 

HP - HPSBHF03725

https://support.hp.com/us-en/document/ish_3890925-3890955-16

 

Dell - DSA-2021-100

https://www.dell.com/support/kbdoc/000186331/

 

Microsoft – MSRC May 2021

https://msrc.microsoft.com/update-guide/releaseNote/2021-May

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-24587

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-24588

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-26144

 

Linux Kernel

https://lore.kernel.org/linux-wireless/20210511180259.159598-1-johannes@sipsolutions.net/

 

Samsung Mobile(Android) – SVE-2021-20775 in SMR-APR-2021

https://security.samsungmobile.com/securityUpdate.smsb

 

SUSE - 000020244

https://www.suse.com/support/kb/doc/?id=000020244

 

Canonical(Ubuntu)

https://ubuntu.com/security/CVE-2020-24586

https://ubuntu.com/security/CVE-2020-24587

https://ubuntu.com/security/CVE-2020-24588

https://ubuntu.com/security/CVE-2020-26139

https://ubuntu.com/security/CVE-2020-26140

https://ubuntu.com/security/CVE-2020-26141

https://ubuntu.com/security/CVE-2020-26142

https://ubuntu.com/security/CVE-2020-26143

https://ubuntu.com/security/CVE-2020-26144

https://ubuntu.com/security/CVE-2020-26145

https://ubuntu.com/security/CVE-2020-26146

https://ubuntu.com/security/CVE-2020-26147

 

Debian

https://security-tracker.debian.org/tracker/CVE-2020-24586

https://security-tracker.debian.org/tracker/CVE-2020-24587

https://security-tracker.debian.org/tracker/CVE-2020-24588

https://security-tracker.debian.org/tracker/CVE-2020-26139

https://security-tracker.debian.org/tracker/CVE-2020-26140

https://security-tracker.debian.org/tracker/CVE-2020-26141

https://security-tracker.debian.org/tracker/CVE-2020-26142

https://security-tracker.debian.org/tracker/CVE-2020-26143

https://security-tracker.debian.org/tracker/CVE-2020-26145

https://security-tracker.debian.org/tracker/CVE-2020-26147