# Fragmentation and Aggregation Flaws in Wi-Fi

FragAttacks: unauthenticated A-MSDU flag and fragment reassembly flaws in Wi-Fi let attackers inject packets or exfiltrate data across Linux, FreeBSD, NetBSD, OpenBSD.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: vanhoefm
- Disclosed: 2021-07-23
- CVE: CVE-2020-26140, CVE-2020-26143, CVE-2020-26145, CVE-2020-26144, CVE-2020-26139, CVE-2020-26146, CVE-2020-26147, CVE-2020-26142, CVE-2020-26141, CVE-2020-24588, CVE-2020-24587, CVE-2020-24586
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1238470
- Library page: https://bugbountylibrary.com/r/h1%3A1238470
- Tags: area:devices domain:network impact:data-leak impact:integrity impact:internal-access kind:bounty platform:hackerone sev:high tech:linux technique:source-review vuln:crypto vuln:misconfiguration

**Target:** Wi-Fi 802.11 stack (Linux, FreeBSD, NetBSD, OpenBSD drivers and access points)
**Root cause:** The A-MSDU flag in the plaintext Wi-Fi header is not authenticated, and receivers reassemble fragments across keys, non-consecutive packet numbers, or mixed plaintext/encrypted without clearing cache on reassociation.
**Steps:**
1. Set the A-MSDU flag in the plaintext header of a frame sent to a victim to make it parse aggregated subframes (CVE-2020-24588).
2. Inject a plaintext data frame into a protected network where the AP/client accepts it (CVE-2020-26140).
3. Send fragmented plaintext frames or plaintext broadcast fragments treated as full frames (CVE-2020-26143, CVE-2020-26145).
4. Send plaintext A-MSDU starting with RFC1042 header EtherType EAPOL (CVE-2020-26144).
5. Reassemble encrypted fragments with non-consecutive packet numbers or mixed encrypted/plaintext fragments to exfiltrate data (CVE-2020-26146, CVE-2020-26147).
6. Exploit fragment cache not cleared on reassociation to leak or inject (CVE-2020-24586).
**How found:** Design-level analysis of the 802.11 fragmentation and aggregation state machine, testing many network cards and open source drivers/APs to find which accepted plaintext, mixed, or out-of-order fragments.
**Exploitation:** Attacker within radio range injects arbitrary packets to a victim client, e.g. spoofing DHCP/DNS to point the client at a malicious DNS server for SSL stripping, or punching NAT holes to reach internal IoT/Windows devices; data exfiltration requires another device sending fragmented frames and no higher-layer encryption.
**Escalation:** Chains packet injection into DNS hijack/SSL stripping or NAT traversal to attack internal hosts (IoT, BlueKeep on Windows 7).
**Insight:** The A-MSDU flag and fragment reassembly state live in the unauthenticated plaintext header; audit any protocol where a header bit changes how the encrypted payload is parsed, and test fragment caches across reassociation and key changes.