AP-side workaround for WNM-Sleep Mode GTK/IGTK reinstallation issues
Normally, WNM-Sleep Mode exit with management frame protection negotiated would result in the current GTK/IGTK getting added into the WNM-Sleep Mode Response frame. Some station implementations may have a vulnerability that results in GTK/IGTK reinstallation based on this frame being replayed. Add a new hostapd configuration parameter that can be used to disable that behavior and use EAPOL-Key frames for GTK/IGTK update instead. This would likely be only used with wpa_disable_eapol_key_retries=1 that enables a workaround for similar issues with EAPOL-Key. This is related to station side vulnerabilities CVE-2017-13087 and CVE-2017-13088. To enable this AP-side workaround, set wnm_sleep_mode_no_keys=1. Signed-off-by: Jouni Malinen <j@w1.fi>master
parent
3f5a1860a8
commit
348c93847a
Loading…
Reference in New Issue