The Patching Friars' AlmanacA calendar of CVE saints

Patron of May 11

FragAttacksHoly card for fragattacks, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 FragAttacks FRAGMENTA RECOLLIGO
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint FragAttacks, Who Reassembles the Pieces His Own Way

Patron of Wi-Fi networks of every era, fragments forgotten in memory, and routers that will never see an update.

Life

On 11 May 2021 Mathy Vanhoef, the same researcher behind KRACK, presented FragAttacks: a dozen Wi-Fi vulnerabilities, three of them in the design of the 802.11 standard itself, present since its beginnings in 1997. By playing with packet aggregation and fragmentation, an attacker within range could inject packets or, in some cases, steal data, on WEP as much as on WPA3. Almost every device was hit by at least one flaw.

Prayer

O Saint FragAttacks, who puts fragments back together as he pleases, let our packets reassemble only from their own pieces. Amen.

How to celebrate

Celebrated by updating routers, network cards and phones, and using HTTPS even on the home network.

A forgotten fragment makes a poisoned packet.

Technical record

Disclosed on
May 11 2021
CVE
CVE-2020-24586CVE-2020-24587CVE-2020-24588

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.

Sources: fragattacks.com

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.