FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD -- Unauthenticated EAPOL-Key Decryption Vulnerability

Affected packages
11.2 <= FreeBSD < 11.2_2
11.1 <= FreeBSD < 11.1_13
10.4 <= FreeBSD < 10.4_11

Details

VuXML ID 45671c0e-a652-11e8-805b-a4badb2f4699
Discovery 2018-08-14
Entry 2018-08-22

Problem Description:

When using WPA2, EAPOL-Key frames with the Encrypted flag and without the MIC flag set, the data field was decrypted first without verifying the MIC. When the dta field was encrypted using RC4, for example, when negotiating TKIP as a pairwise cipher, the unauthenticated but decrypted data was subsequently processed. This opened wpa_supplicant(8) to abuse by decryption and recovery of sensitive information contained in EAPOL-Key messages.

See https://w1.fi/security/2018-1/unauthenticated-eapol-key-decryption.txt for a detailed description of the bug.

Impact:

All users of the WPA2 TKIP pairwise cipher are vulnerable to information, for example, the group key.

References

CVE Name CVE-2018-1452
FreeBSD Advisory SA-18:11.hostapd