CVE-2017-13077: Medium severity Apple macOS High Sierra vulnerability
A new exploitation technique called key reinstallation attacks used to break Wi-Fi handshakes that negotiate session keys was discovered. These attacks target the Wi-Fi/WPA2 standard. An adversary can trick a client or Access Point (AP) into reinstalling an already-in use pairwise key in 4-way handshake. While reinstalling the already in-use key, the associated packet number (sometimes also called nonce) and receive replay counter is reset. This causes nonce reuse, voiding any security the underlying encryption protocol is supposed to provide. For example, it allows decryption or injection of frames, and enables an attacker to replay frames.
Other sources
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
— MITRE
Wi-Fi. A logic issue existed in the handling of state transitions. This was addressed with improved state management.
Credit
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2016-0736
- CVE-2016-2161
- CVE-2016-5387
- CVE-2016-8740
- CVE-2016-8743
- CVE-2017-3167
- CVE-2017-3169
- CVE-2017-7659
- CVE-2017-7668
- CVE-2017-7679
- CVE-2017-9788
- CVE-2017-9789
- CVE-2017-13786
- CVE-2017-13800
- CVE-2017-13809
- CVE-2017-13820
- CVE-2017-13807
- CVE-2017-13829
- CVE-2017-13833
- CVE-2017-13821
- CVE-2017-13825
- CVE-2017-1000100
- CVE-2017-1000101
- CVE-2017-13801
- CVE-2017-13815
- CVE-2017-13828
- CVE-2017-13811
- CVE-2017-13830
- CVE-2017-11103
- CVE-2017-13819
- CVE-2017-13814
- CVE-2017-13831
- CVE-2017-13906
- CVE-2017-13810
- CVE-2017-13817
- CVE-2017-13818
- CVE-2017-13836
- CVE-2017-13841
- CVE-2017-13840
- CVE-2017-13842
- CVE-2017-13782
- CVE-2017-13843
- CVE-2017-13834
- CVE-2017-13799
- CVE-2017-13852
- CVE-2017-13813
- CVE-2017-13812
- CVE-2016-4736
- CVE-2017-5969
- CVE-2017-5130
- CVE-2017-7376
- CVE-2017-9050
- CVE-2017-9049
- CVE-2018-4390
- CVE-2018-4391
- CVE-2017-13907
- CVE-2017-13824
- CVE-2017-13846
- CVE-2017-10140
- CVE-2017-13822
- CVE-2017-7132
- CVE-2017-13823
- CVE-2017-13808
- CVE-2017-13838
- CVE-2017-7170
- CVE-2017-7150
- CVE-2017-13908
- CVE-2017-13804
- CVE-2017-11108
- CVE-2017-11541
- CVE-2017-11542
- CVE-2017-11543
- CVE-2017-12893
- CVE-2017-12894
- CVE-2017-12895
- CVE-2017-12896
- CVE-2017-12897
- CVE-2017-12898
- CVE-2017-12899
- CVE-2017-12900
- CVE-2017-12901
- CVE-2017-12902
- CVE-2017-12985
- CVE-2017-12986
- CVE-2017-12987
- CVE-2017-12988
- CVE-2017-12989
- CVE-2017-12990
- CVE-2017-12991
- CVE-2017-12992
- CVE-2017-12993
- CVE-2017-12994
- CVE-2017-12995
- CVE-2017-12996
- CVE-2017-12997
- CVE-2017-12998
- CVE-2017-12999
- CVE-2017-13000
- CVE-2017-13001
- CVE-2017-13002
- CVE-2017-13003
- CVE-2017-13004
- CVE-2017-13005
- CVE-2017-13006
- CVE-2017-13007
- CVE-2017-13008
- CVE-2017-13009
- CVE-2017-13010
- CVE-2017-13011
- CVE-2017-13012
- CVE-2017-13013
- CVE-2017-13014
- CVE-2017-13015
- CVE-2017-13016
- CVE-2017-13017
- CVE-2017-13018
- CVE-2017-13019
- CVE-2017-13020
- CVE-2017-13021
- CVE-2017-13022
- CVE-2017-13023
- CVE-2017-13024
- CVE-2017-13025
- CVE-2017-13026
- CVE-2017-13027
- CVE-2017-13028
- CVE-2017-13029
- CVE-2017-13030
- CVE-2017-13031
- CVE-2017-13032
- CVE-2017-13033
- CVE-2017-13034
- CVE-2017-13035
- CVE-2017-13036
- CVE-2017-13037
- CVE-2017-13038
- CVE-2017-13039
- CVE-2017-13040
- CVE-2017-13041
- CVE-2017-13042
- CVE-2017-13043
- CVE-2017-13044
- CVE-2017-13045
- CVE-2017-13046
- CVE-2017-13047
- CVE-2017-13048
- CVE-2017-13049
- CVE-2017-13050
- CVE-2017-13051
- CVE-2017-13052
- CVE-2017-13053
- CVE-2017-13054
- CVE-2017-13055
- CVE-2017-13687
- CVE-2017-13688
- CVE-2017-13689
- CVE-2017-13690
- CVE-2017-13725
- CVE-2017-13077
- CVE-2017-13078
- CVE-2017-13080
- CVE-2017-15401
- CVE-2017-15402
- CVE-2017-15400
- CVE-2017-15397
Frequently Asked Questions
What is the severity of CVE-2017-13077?
The CVE-2017-13077 vulnerability has a high severity rating due to its potential exploitation in WPA and WPA2 networks.
How do I fix CVE-2017-13077?
To fix CVE-2017-13077, update the affected software to the latest version where the vulnerability has been patched.
Which systems are affected by CVE-2017-13077?
CVE-2017-13077 affects various operating systems including Android, macOS High Sierra, different versions of Ubuntu, Debian, FreeBSD, and several versions of the Hostapd and WPA Supplicant.
What type of vulnerability is CVE-2017-13077?
CVE-2017-13077 is a logic issue in Wi-Fi state transition handling that can allow an attacker to reinstall keys during the four-way handshake.
Is there a known exploit for CVE-2017-13077?
Yes, CVE-2017-13077 is part of the KRACK attack vector which demonstrates a practical exploit against WPA2.