FragAttacks: summary of findings
Mathy Vanhoef
Draft version 1, 8 March 2021

Table of contents
Design flaws:
1. Design flaw: aggregation attack (CVE-2020-24588)
2. Design flaw: mixed key attack (CVE-2020-24587)
3. Design flaw: fragment cache attack (CVE-2020-24586)

2

Table of contents› Implementation flaws allowing trivial plaintext injection:
4. Accepting plaintext frames (CVE-2020-26140 / 26143)
6. Plaintext broadcast fragments (CVE-2020-26145)
7. Cloacked aggregated frames (CVE-2020-26144)› Other implementation flaws:8. Pre-auth EAPOL forwarding (CVE-2020-26139)
9. Non-consecutive packet numbers (CVE-2020-26146)
10. Mixed plain/encrypted fragments (CVE-2020-26147)
11. No fragmentation support (CVE-2020-26142)
3

Aggregation Attack
CVE-2020-24588
4

Root cause› The “is aggregated” flag in the Wi-Fi header is not protected:
802.11 header

headeris aggregatedpayloadAuthenticatedNot protected

Authenticated & encrypted› An adversary can flip the “is aggregated” flag
› Payload will be parsed differently  allows packet injection
5Impact
TargetPreconditions

ImpactClientClient connects to attacker’s server

Inject packets to client

AP is vulnerable to CVE-2020-26139

Inject packets to client

Client connects to attacker’s server
and this client uses predictable IP IDs

Inject packets to AP

AP

Example attack: make client use a malicious DNS server orbypass the AP’s NAT to directly access local devices
6

Mixed Key Attack
CVE-2020-24587
7

Root cause› Fragments encrypted under different keys are reassembled:
𝐸𝑛𝑐𝑘 (𝐹𝑟𝑎𝑔0 𝑠 )𝐸𝑛𝑐𝒌 (𝐹𝑟𝑎𝑔0 𝑠 )Refresh session key from 𝒌 to 𝐦
𝐸𝑛𝑐𝑚 (𝐹𝑟𝑎𝑔1 𝑠′ )𝐸𝑛𝑐𝒎 (𝐹𝑟𝑎𝑔1 𝑠 )› Receiver will decrypt & reassemble fragments 𝐹𝑟𝑎𝑔0 and 𝐹𝑟𝑎𝑔1› Can be abused to forge frames by mixing fragments
8Impact
TargetPreconditions

ImpactAP

Client connects to attacker’s server and client
sens fragmented frames and the network
refreshes session keys (= unlikely in practice)

Exfiltrate data sent
by client

ClientOnly a theoretic concern (see paper)

Theoretic (seepaper)

Example attack: exfiltrate a web brower cookieof the client when plaintext HTTP is used
9

Fragment Cache Attack
CVE-2020-2458610

Root cause› The fragment cache isn’t cleared when (re)connecting:
𝐸𝑛𝑐𝑘 (𝐹𝑟𝑎𝑔0 𝑠 )Store fragment

Disconnect & let client connect
𝐸𝑛𝑐𝑚 (𝐹𝑟𝑎𝑔1 𝑠′ )𝐸𝑛𝑐𝑚 (𝐹𝑟𝑎𝑔1 𝑠 )› Attacker’s fragment 𝐹𝑟𝑎𝑔0 & the client’s 𝐹𝑟𝑎𝑔1 is reassembled› Can be abused to exfiltrate & forge frames by mixing fragments
11Impact
TargetPreconditions

ImpactAP

Target is an enterprise network and client
sends fragmented frames (fairly unlikely)

Exfiltrate data sent
by client and inject
packets to AP

ClientClient will connect to the adversary’s network(but won’t trust it) and the AP sends
fragmented frames (seems unlikely)

Inject packets toclient

Example attacks: exfiltrate a plaintext brower cookie, makeclient use a malicious DNS server, bypass the AP’s NAT
12

Implementation Flaws:
trivial plaintext injection
13

Accepted plaintext frames (CVE-2020-26140 / 26143)
Accepting plaintext frames (CVE-2020-26140)› Examples: some routers, some dongles on Linux/Windows
Accepting fragmented plaintext frames (CVE-2020-26143)› Examples: many dongles on Windows, some FreeBSD APs
 Can inject frames indepedent of network config
14Plaintext broadcast fragments (CVE-2020-26145)
Some devices accept plaintext broadcast fragments› Sometimes only accepted while connecting› Treated as full frames!
› Examples: MacOS, iOS, and Free/NetBSD APs

 Can inject frames indepedent of network config

15

Cloacked aggregated frames (CVE-2020-26144)
Some accept aggregate frames that resemble EAPOL frames› Sometimes only accepted while connecting› 2nd subframe of aggregate frame can contain arbitrary data
› Examples: Huawei Y6’, Nexus 5X, FreeBSD, LANCOM APs

 Can inject frames indepedent of network config

16

Implementation flaws
with other impact17Non-consective packet numbers (CVE-2020-26146)
Accepting fragments with non-consecutive packet numbers› Related fragments must have consecutive packet numbers› But almost nobody checks this! Only Linux does.
Can abuse this to exfiltrate data sent by a client if:› The client is tricked into visiting the attacker’s server› The client sends fragmented frames
18

Mixed plain/encrypted fragments (CVE-2020-26147)
Some reassemble mixed plaintext and encrypted fragments› Practically all devices are affected
Can abuse to inject frames› If 1st fragment must be encrypted:
Inject frames when combined with other vulnerabilities (non-trivial)› If last fragment must be encrypted:
Inject frames when another device sends fragmented frames
19Pre-auth EAPOL forwarding (CVE-2020-26139)
Some APs forwards EAPOL frames before sender is authenticated› Examples: Net/FreeBSD APs and 2 4 home routers
1. Associate

3. EAPOL frame

2. EAPOL frame Abuse to inject frames in combination withaggregation attack (CVE-2020-24588)
20

No fragmentation support (CVE-2020-26142)
Some devices don’t support fragmentation› They treat fragmented frames as full frames› Examples: OpenBSD and ESP12-F
Abuse to inject frames when:› Another device sends fragmented frames› This other device visits the attacker’s server
21

Discussion
22

Practicality vs. impact
Perhaps we’re lucky:› Widespread flaws  relatively trickly to exploit in practice› Trivial to exploit flaws  not widespread in practice (?)
Important concerns remain:› Significant #devices affected by trivial to exploit flaws› Every Wi-Fi device affected by one or more flaws› Combining flaws increases practicality of certain attacks

 Patch now before attack improve!
23