|Number of vulnerabilities||1|
|CVE ID|| CVE-2018-14526
|Public exploit||Not available|
|Vulnerable software versions||
|Vendor URL||Jouni Malinen|
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists on the systems where WPA2/RSN style of EAPOL-Key construction is used with TKIP negotiated as the pairwise cipher due to an error when processing malicious input. A remote attacker can send specially crafted unauthenticated EAPOL-Key frame data to modify the Group Transient Key (GTK) and prevent the target system from accepting group-addressed frames.Remediation
The vendor offers possible mitigation steps:
- Remove TKIP as an allowed pairwise cipher in RSN/WPA2 networks. This
can be done also on the AP side.
- Merge the following commits to wpa_supplicant and rebuild:
WPA: Ignore unauthenticated encrypted EAPOL-Key data
- Update to wpa_supplicant v2.7 or newer, once available.