# FragAttacks: Wi-Fi fragmentation and aggregation injection flaws

FragAttacks: Wi-Fi fragmentation/aggregation flaws in 802.11 defrag and A-MSDU parsing let attackers inject packets into protected WPA2/WPA3 networks.

- Payout: unconfirmed
- Severity: high
- Program: Internet Bug Bounty
- Credited: Mathy Vanhoef
- Disclosed: 2021-07-23
- CVE: CVE-2020-24588, CVE-2020-24587, CVE-2020-24586, CVE-2020-26146, CVE-2020-26147, CVE-2020-26140, CVE-2020-26143, CVE-2020-26145
- Write-up quality: 9/10
- Original: https://github.com/vanhoefm/fragattacks#fragattacks-fragmentation--aggregation-attacks
- Library page: https://bugbountylibrary.com/r/blog%3Agithub-com-vanhoefm-fragattacks
- Tags: domain:network impact:integrity kind:bounty platform:blog sev:high tech:linux technique:chained technique:source-review vuln:auth-bypass vuln:misconfiguration vuln:race-condition

**Target:** Wi-Fi clients and access points (802.11 defragmentation/A-MSDU parsing)
**Root cause:** Receivers fail to properly clear fragments on (re)connect, mix fragments from different keys, accept non-consecutive PNs, accept plaintext fragments in protected networks, and trust the unauthenticated A-MSDU flag, enabling frame reassembly/injection.
**Steps:**
1. Install patched drivers/firmware and supported NIC (e.g. AWUS036ACM) in mixed mode.
2. Run `./fragattack.py wlan0 --ap $COMMAND` against client or AP.
3. A-MSDU: `amsdu-inject` sends A-MSDU whose start is a valid rfc1042 header (CVE-2020-24588).
4. Mixed key: `ping I,F,BE,AE --pn-per-qos` injects two fragments under different keys (CVE-2020-24587).
5. Cache: `ping I,E,R,AE --full-recon` injects fragment, reassociates, injects second fragment (CVE-2020-24586).
6. Plain/encrypt: `ping I,E,P` / `ping I,P` / `ping I,P,P` inject plaintext fragments (CVE-2020-26147/26140/26143).
7. Broadcast: `ping I,D,P --bcast-ra` injects unicast ping in plaintext broadcast 2nd fragment (CVE-2020-26145).
8. EAPOL: `eapol-amsdu I,P` cloaks ping as EAPOL in plaintext A-MSDU (CVE-2020-26144).
**How found:** Code audit and dynamic testing of 802.11 defragmentation and A-MSDU parsing across many implementations; observed fragments persisting after reconnect, non-consecutive PNs accepted, and plaintext fragments accepted, then built a test tool to confirm each variant.
**Exploitation:** Attacker within Wi-Fi range injects crafted fragmented/A-MSDU frames; by combining mixed-key, cache, or plaintext-fragment flaws with A-MSDU parsing, arbitrary packets (e.g. ICMP, TCP) are injected into the victim's connection despite WPA2/WPA3 encryption.
**Escalation:** Chaining implementation flaws (A-MSDU + mixed plain/encrypt, or cache + plaintext) raises impact from single-frame injection to arbitrary packet injection into protected traffic.
**Insight:** When auditing wireless or any reassembly logic, check whether partial fragments survive disconnect/rekey, whether sequence/PN continuity is enforced, and whether header flags (like A-MSDU) are authenticated before being trusted.