Skip to content

Home Special Announcement WPA2 Key Reinstallation Vulnerabilities
WPA2 Key Reinstallation Vulnerabilities

Description:
Key reinstallation attacks or "KRACK" attacks were reported in the WPA2 Wi-Fi protocol. An attacker within range of an affected AP and client may be able to conduct attacks including arbitrary packet decryption and injection, TCP connection hijacking, HTTP content injection, or the replay of unicast and group-addressed frames.

CVE Number:
CVE-2017-13077: Reinstallation of the pairwise key in the Four-way handshake
CVE-2017-13078: Reinstallation of the group key in the Four-way handshake
CVE-2017-13079: Reinstallation of the integrity group key in the Four-way handshake
CVE-2017-13080: Reinstallation of the group key in the Group Key handshake
CVE-2017-13081: Reinstallation of the integrity group key in the Group Key handshake
CVE-2017-13082: Accepting a retransmitted Fast BSS Transition Reassociation Request and reinstalling the pairwise key while processing it
CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake
CVE-2017-13086: Reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake
CVE-2017-13087: Reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame
CVE-2017-13088: Reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame


Systems Affected:
The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations. Therefore, any Wi-Fi device that uses WPA2 is likely affected.

Mitigation:
1. Users are advised to install updates to affected devices as they are available or contact your vendors directly for update information.

Reference:
https://www.krackattacks.com/
http://www.kb.cert.org/vuls/id/228519

 
[YOUR IP : 54.162.118.107: 55850] ...   [YOUR BROWSER: CCBot/2.0 (https://commoncrawl.org/faq/)] ...