CVE-2017-13080

What it actually does

Allows reinstallation of the Group Temporal Key (GTK) during the group key handshake in WPA/WPA2, enabling an attacker within radio range to replay previously captured frames from access points to wireless clients.

Why it matters to the business

Permits integrity violations on wireless networks, potentially allowing attackers to inject or replay traffic that could disrupt operations, bypass access controls, or manipulate data in transit on affected Wi-Fi deployments across enterprise and consumer environments.

How an attack unfolds

An attacker positioned within radio range of a vulnerable WPA/WPA2 access point and client initiates or observes the group key handshake, sends crafted messages to force GTK reinstallation with the same key and nonce, then replays previously captured encrypted frames to the client.

How to fix it

Apply vendor-supplied patches to wpa_supplicant, hostapd, and affected operating system Wi-Fi stacks; regenerate and rotate wireless keys after patching; disable affected protocols where feasible until updates are deployed.

How to confirm the fix worked

Verify updated versions of wpa_supplicant (0.7.3+ with patches), hostapd, and kernel Wi-Fi drivers; perform handshake testing with tools that simulate GTK reinstallation attempts; confirm absence of key reinstallation behavior in packet captures.

Typical attack path

1. Position attacker-controlled device within radio range of target access point and client
2. Trigger or observe the group key handshake between access point and client
3. Send specially crafted EAPOL frames to force reinstallation of the existing GTK
4. Capture and replay previously transmitted frames from the access point to the client
5. Leverage replayed frames to inject traffic or bypass network controls

How to detect it

Inspect wireless packet captures for anomalous group key handshake sequences involving repeated GTK installation with identical key data; review client logs for repeated GTK updates during a single association; correlate with physical proximity indicators in wireless management frames.

What your security team should do

• Prioritize patching all wireless clients and access points running affected wpa_supplicant or hostapd versions
• Inventory and update Linux distributions and embedded devices using these components
• Monitor vendor advisories for per-package fixed versions and schedule immediate deployment
• Consider network segmentation for legacy wireless devices that cannot be promptly patched