WPA/WPA2 Vulnerability in Hostapd and Wpa_supplicant: Key Reinstallation Attack
Summary
ALPINE-CVE-2017-13088: Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attac... Affects hostapd versions < 2.6-r2. Fixed in 2.6-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hostapd and Wpa_supplicant are essential components in managing wireless networks, providing functionalities such as authentication and encryption for Wi-Fi connections. These packages are widely used in various Linux distributions, including Alpine Linux, to facilitate secure wireless communications. However, they are susceptible to a critical vulnerability that allows attackers to exploit the key reinstallation process, potentially compromising network security.
Vulnerability Detail
The vulnerability, identified as CVE-2017-13088, arises from the handling of Wireless Network Management (WNM) Sleep Mode Response frames in WPA and WPA2 protocols. This flaw allows an attacker within radio range to replay frames from access points to clients by reinstalling the Integrity Group Temporal Key (IGTK). The ramifications of this vulnerability include unauthorized access to sensitive data and the potential for man-in-the-middle attacks, making it a significant threat to wireless network integrity.
How To Fix
Minimum fixed version
2.6-r2
This is the first release that contains the fix.
sudo apk add --upgrade hostapdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the WNM feature in their wireless configuration to mitigate the risk of exploitation until the packages are updated. This can be done by modifying the configuration files for Hostapd and Wpa_supplicant to ensure that WNM is not enabled.
Conclusion
The CVE-2017-13088 vulnerability in Hostapd and Wpa_supplicant poses a significant risk to wireless network security. It is essential for users to update their packages to the patched versions to safeguard against potential attacks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for hostapd →
FAQ
CVE-2017-13088 is a vulnerability in the WPA and WPA2 protocols that allows attackers to exploit the key reinstallation process, potentially compromising wireless network security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized access to sensitive data, potential man-in-the-middle attacks, and overall compromise of wireless network integrity.
You can update Hostapd and Wpa_supplicant to their patched versions (2.6-r2 and 2.6-r7 respectively) using the commands: apk update and apk upgrade hostapd wpa_supplicant.
Yes, you can disable the WNM feature in your wireless configuration as a temporary workaround until the packages are updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for hostapd.
