Key management errors in Linux kernel - CVE-2017-13080

Vulnerability identifier: #VU8840

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

CVE-ID: CVE-2017-13080

CWE-ID: CWE-320

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Affected software:
Linux kernel
Gentoo Linux
Debian Linux
Arch Linux
Microsoft Windows
Apple iOS
FortiOS
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Fedora
ArubaOS (AOS)
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - 4 Year Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux Server (for IBM Power LE) - 4 Year Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
FreeBSD
SUSE Linux
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Junos OS
Slackware Linux
Ubuntu
Opensuse
Windows Server
Intel Wi-Fi 6 AX201
Intel Wi-Fi 6 AX200
Intel Wireless-AC 9560
Intel Dual Band Wireless-AC 3165
Intel Wireless 7265 (Rev D) Family
Intel Dual Band Wireless-AC 3168
Intel Dual Band Wireless-AC 8260
Intel Dual Band Wireless-AC 8265
Intel Wireless-AC 9260
Intel Wireless-AC 9461
Intel Wireless-AC 9462
Aironet
Cisco WAP121
Cisco ASA 5506W-X w
Cisco Spark Room Series
Cisco IP Phone 8865
Cisco IP Phone 8861
Cisco DX80 Series IP Phones
Cisco DX70 Series IP Phones
Cisco WAP321
Cisco WAP371
Cisco WAP551
Cisco WAP561
Stratix 5100
Cisco Meraki
Cisco Wireless IP Phone 8821
ESP-IDF
supplicant (Red Hat package)
wpa_supplicant
hostapd
wpa_supplicant-debuginfo
wpa_supplicant-debugsource

The vulnerability allows an adjacent attacker to force a supplicant to reinstall a previously used group key.

The weakness exists in the processing of the 802.11i 4-way handshake messages of the WPA and WPA2 protocols due to ambiguities in the processing of associated protocol messages. An adjacent attacker can use man-in-the-middle techniques to retransmit previously used message exchanges between supplicant and authenticator.

The vulnerability is dubbed "KRACK" attack.

Update Linux kernel to version 4.13.14 or 4.9.63.

• https://www.krackattacks.com/
• https://papers.mathyvanhoef.com/ccs2017.pdf