CVE-2015-5310

What it actually does

The flaw permits injection of arbitrary broadcast or multicast packets or denial of service because WNM Sleep Mode response frames are not properly validated for key data when management frame protection was never negotiated.

Why it matters to the business

Nearby attackers can disrupt wireless connectivity or inject traffic into the network, leading to intermittent outages, potential data leakage, and degraded reliability on affected Android devices.

How an attack unfolds

An attacker on the same wireless network sends a crafted WNM Sleep Mode response frame containing malicious key data to a device that did not negotiate MFP; the vulnerable wpa_supplicant code accepts the frame, resulting in packet injection or dropped legitimate packets.

How to fix it

Upgrade wpa_supplicant to 2.6 or later; apply the latest vendor security updates for Google Android devices that incorporate the fixed code.

How to confirm the fix worked

Confirm wpa_supplicant version 2.6 or newer is installed, verify Android security patch level includes the WNM Sleep Mode fix, and test that MFP negotiation occurs where supported.

Typical attack path

1. Position on the same Wi-Fi network as the target
2. Capture or infer lack of MFP negotiation
3. Transmit malicious WNM Sleep Mode response frame
4. Achieve broadcast/multicast injection or denial of service

How to detect it

Inspect wireless packet captures for unexpected WNM Sleep Mode response frames that lack proper protection; review device logs for sudden increases in ignored multicast packets or connectivity flaps without corresponding client actions.

What your security team should do

• Prioritize deployment of current Android security patches across the fleet
• Disable WNM Sleep Mode where operationally feasible
• Monitor wireless traffic for anomalous WNM frames
• Enforce MFP on all supported access points