MTW_AID2WCID hashes 64 station AIDs into 8 WCIDs: in hostap with >8 stations the 9th+ pairwise key overwrites a colliding station's key slot, and downlink frames are then encrypted with ANOTHER station's key (cross-station confidentiality break on WPA2-Enterprise)
Summary
MTW_AID2WCID(aid)=1+(aid&0x7) maps 64 AIDs (iv_max_aid=MTW_WCID_MAX=64) onto WCIDs 1..8 while hardware key tables are WCID-indexed to 64: AIDs 9..64 collide with 1..8 - the later station's key overwrites the colliding earlier one and tx encrypts with txwi->wcid=hash -> victim's downlink unicast frames encrypted under the attacker's pairwise key (attacker decrypts victim traffic not otherwise possible with per-station EAP keys). Hostap + WPA2-Enterprise + >=9 stations, guaranteed collision within 9. use-AID-directly + cap-max-aid fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5266 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| env.txt | — | 183 B | view raw | |
| fix.diff | — | 895 B | view raw | |
| verdict.json | — | 3.0 KB | view raw |
Fix verification
not_testablefix.diff authored and verified with 'git apply --check' against the pristine sys/ tree, but cannot be kernel-tested: the guest has no USB controller and no MT7601U device model, so neither baseline nor patched kernel behavior is exercisable. Hardware-gated: not_testable.
fix.diff (git-apply clean); VERDICT.md
Confirmed kernel references
Detail
Exploit chain
hostap + WPA2-Enterprise + >=9 stations -> attacker associates, AID collides with victim's (guaranteed within 9) -> attacker's pairwise key lands in victim's WCID slot -> victim's downlink frames encrypted with attacker's key -> attacker decrypts victim traffic
Evidence (decisive lines)
Code-cited: AID2WCID macro, iv_max_aid=MTW_WCID_MAX, key install at MTW_PKEY(wcid), txwi->wcid selection. VERDICT.md collision table (aid 1 & 9 -> wcid 2, aid 2 & 10 -> wcid 3, ...)
Verified recommended fix
Use the AID directly (WCID table supports 64) and cap iv_max_aid at MTW_WCID_MAX-1
Verdict
MTW_AID2WCID(aid) = 1 + (aid & 0x7) (if_mtwvar.h:37) maps all 64 possible AIDs (vap->iv_max_aid = MTW_WCID_MAX = 64, if_mtw.c:820) onto WCIDs 1..8 only, while the hardware key tables are indexed by WCID up to MTW_WCID_MAX=64 (MTW_PKEY(wcid), if_mtwreg.h:258). AIDs 9..64 collide with AIDs 1..8: mtw_key_set_cb() installs the pairwise key of the later station into the shared slot (base = MTW_PKEY(wcid), if_mtw.c:1999-2001), and mtw_tx() encrypts downlink frames with txwi->wcid = MTW_AID2WCID(ni->ni_associd) (3157-3160). From the 9th association on, frames addressed to station A are encrypted under whichever colliding station's key was installed last: on WPA2-Enterprise (per-statement keys) a malicious authenticated station that associates after the victim with a colliding AID receives the ability to decrypt the victim's unicast downlink traffic (the hardware encrypts it with the attacker's key). Deterministic mechanism, verified against the macro and call sites; in-kernel demonstration requires two RF peers and the dongle (hardware-gated).
No comments yet.