Wi-Fi FragAttacks: Frame Aggregation Flaws and Layer 3 VPN Defense

Wireless networks rely on link-layer encryption to shield radio broadcasts from eavesdropping. When connected to Wi-Fi secured with WPA2 or WPA3, users assume payloads remain cryptographically isolated from neighboring devices. Without network credentials, an adversary within radio range should be unable to read or inject packets.

In 2021, security researcher Mathy Vanhoef challenged this assumption with the disclosure of FragAttacks (Fragmentation and Aggregation Attacks). Documented under CVE-2020-24586, CVE-2020-24587, and CVE-2020-24588, FragAttacks revealed architectural and implementation flaws affecting every generation of Wi-Fi since 1997.

By exploiting weaknesses in how IEEE 802.11 aggregates and fragments frames, an attacker can inject arbitrary packets into protected networks without authenticating to the access point. For users roaming across public or enterprise Wi-Fi, surviving these link compromises requires cryptographic defenses independent of local radio protocols.

The IEEE 802.11 Trust Assumption: Encrypted Frames and Frame Aggregation

To optimize throughput, IEEE 802.11n introduced frame aggregation. Prior to aggregation, transmitting small IP packets produced severe MAC-layer overhead from contention windows, inter-frame spacing, and physical preambles.

Frame aggregation bundles packets into a single wireless transmission:

• A-MSDU (Aggregated MAC Service Data Unit): Groups multiple Ethernet frames inside one 802.11 MAC header.
• A-MPDU (Aggregated MAC Protocol Data Unit): Combines distinct 802.11 frames into a unified transmission.

Under WPA2 or WPA3, A-MSDU payloads are encrypted as unified blocks using CCMP or GCMP. The receiving Wi-Fi chip decrypts the frame, validates the integrity tag, and parses internal sub-frame headers before forwarding Ethernet payloads to the kernel.

The architectural vulnerability resides in the 802.11 MAC header. A single bit—the A-MSDU Present flag in the QoS Control field—indicates whether the decrypted payload holds a standard Ethernet frame or an aggregated sequence of sub-frames. The 802.11 standard did not require implementations to authenticate this specific header bit cryptographically.

Mechanics of Wi-Fi Fragmentation: Fragment Numbers, Nonce Reuse, and Reassembly

Alongside aggregation, 802.11 defines frame fragmentation to maintain reliability over noisy channels. When an IP packet exceeds the fragmentation threshold, the sender splits the frame into smaller fragments.

Each fragment receives:

1. A shared 12-bit Sequence Number identifying the frame.
2. A sequential 4-bit Fragment Number (0 to 15).
3. A More Fragments flag set on all parts except the final fragment.

+-------------------------------------------------------------------------+
|                         IEEE 802.11 MAC Header                          |
|  Frame Control | Duration | Addr 1 | Addr 2 | Addr 3 | Seq Ctrl | Addr 4|
+-------------------------------------------------------------------------+
                                                           |
                                 +-------------------------+
                                 v
                 +-------------------------------+
                 |  Sequence Number  | Frag Num  |
                 |      (12 bits)    |  (4 bits) |
                 +-------------------------------+

The receiver buffers arriving fragments. Once all parts arrive, the network driver reassembles the original packet and delivers it to the operating system.

However, the specification contains serious oversights:

• No Cache Invalidation: Receivers do not clear fragment caches when a client disconnects or roams.
• Missing Cipher Alignment: Receivers do not verify whether all fragments were encrypted under the same temporal key.
• Header Decoupling: Reassembly routines process fragments before verifying whether sub-headers match expected transport state.

These gaps enable adversaries to execute stealthy frame injection attacks against connected devices.

Threat Vectors: How FragAttacks Circumvent WPA2 and WPA3 Protections

FragAttacks exploit divergence between link encryption and driver reassembly routines. By manipulating frame headers, attackers execute three primary attack classes.

Aggregated Frame Injection via the A-MSDU Header Flag

Cataloged as CVE-2020-24588, this attack exploits the unauthenticated A-MSDU Present bit in the QoS Control field.

An attacker within radio range observes an encrypted frame transmitted from an access point to a client. Although the adversary cannot read the encrypted payload, they can manipulate the plaintext 802.11 MAC header during transmission:

1. The adversary tricks the victim into receiving a packet embedding an internal Ethernet frame.
2. When transmitted over the air, the attacker flips the A-MSDU Present bit in the outer MAC header from 0 to 1.
3. The victim Wi-Fi card decrypts the frame with its legitimate key. The integrity check succeeds because the ciphertext was unaltered.
4. The Wi-Fi driver inspects the header, sees A-MSDU Present = 1, and treats the decrypted data as an aggregated sub-frame sequence.

The victim operating system unpacks the crafted inner sub-frame and injects it into the local network stack as an authentic packet.

Mixed Key Fragment Cache Poisoning Across Client Sessions

Cataloged as CVE-2020-24587, this vulnerability targets fragment reassembly buffers inside Wi-Fi chips and drivers.

Because Wi-Fi receivers retain fragment caches across disconnections, an attacker can poison the buffer:

1. The attacker connects to a network and transmits an incomplete fragment (Fragment 0 with a malicious IP header) addressed to the router.
2. The attacker disconnects, leaving the fragment dormant in memory.
3. A legitimate client authenticates and transmits a multi-fragment frame.
4. The access point combines the stored malicious Fragment 0 with the client legitimate Fragment 1.

The composite packet merges attacker routing headers with valid client authentication state, enabling payload smuggling and firewall traversal.

Plaintext Frame Injection: Exploiting Unprotected Handshake Exceptions

Beyond aggregation and fragmentation flaws, FragAttacks exposed vulnerabilities in how devices process unencrypted frames (CVE-2020-24586).

To support initial onboarding, 802.11 permits specific management and authentication frames to transmit in plaintext prior to four-way handshake completion:

Many network drivers fail to enforce strict state checks. When an attacker sends a plaintext frame mimicking ARP replies or DHCP leases, vulnerable chipsets forward it to the host IP stack without verifying encryption status.

Practical Attack Scenarios: DNS Spoofing, NAT Piercing, and Router Traversal

Once frame injection succeeds, an attacker can manipulate traffic without cracking the WPA passphrase:

[Adversary Node]                [Wi-Fi Access Point]             [Target Client]
       |                                 |                              |
       |-- Injects Crafted A-MSDU Frame->|                              |
       |   (Unauthenticated QoS Header)  |                              |
       |                                 |-- Delivers Decrypted Frame-->|
       |                                 |   Unpacks Malicious Sub-Frame|
       |                                 |                              |
       |<--------- Outbound DNS Query Leaks to Rogue Resolver ----------|
       |           (Attacker spoofed local DNS via injected frame)      |

1. Local DNS Cache Poisoning: The attacker injects a rogue DNS response into the client stack, overwriting records to direct traffic to malicious servers.
2. TCP Port Piercing and NAT Inversion: Injecting an outbound TCP SYN packet with the victim source IP opens pinholes in the router NAT table, exposing internal services to inbound connections.
3. Malicious ICMP Redirects: Injected ICMP redirect frames alter host routing tables, directing local flows to adversary nodes. Readers examining local network hazards can inspect our guide on ARP spoofing and cache poisoning.

Firmware and Driver Patching Limitations: The Unpatched IoT Legacy

Following coordinated disclosure by the Wi-Fi Alliance, major operating systems updated driver reassembly routines:

• Linux kernels patched mac80211 and cfg80211 subsystems.
• Windows and Apple issued driver updates enforcing fragment validation.

However, resolving FragAttacks globally remains incomplete due to hardware lifecycle constraints:

• Abandoned IoT Devices: Smart home appliances, cameras, and embedded systems rarely receive firmware updates. Millions of microcontrollers remain permanently vulnerable.
• Legacy Access Points: Residential gateways and hospitality routers operate on frozen firmware where vendor support ended years ago.
• Embedded SoC Microcode: Several vulnerabilities reside in ROM-based Wi-Fi baseband chipsets unpatchable via software drivers alone.

Because users cannot audit wireless hardware in hotels, cafes, or airports, relying on Wi-Fi link encryption introduces persistent risk.

Layer 3 VPN Architecture: Cryptographic AEAD Datagram Encapsulation

To render Wi-Fi frame injection powerless, security architectures must operate above the link layer. A modern Layer 3 VPN isolates application traffic inside an end-to-end cryptographic envelope.

+------------------------------------------------------------------------+
|                      User Application Payload                          |
+------------------------------------------------------------------------+
                                    |
                                    v (Layer 3 Virtual Adapter)
+------------------------------------------------------------------------+
|             WireGuard / RiceGuard Outer Encapsulation                  |
|   Authenticated Encryption: ChaCha20-Poly1305 (RFC 7539 / RFC 5116)   |
|   [ 16-byte Poly1305 MAC Tag covers entire inner IP packet & header ]  |
+------------------------------------------------------------------------+
                                    |
                                    v (Physical Wi-Fi Interface wlan0)
+------------------------------------------------------------------------+
|                     Wi-Fi Layer 2 Vulnerable Link                      |
|   A-MSDU / Fragmentation Flaws: Injected Frames Lack Valid AEAD Tag     |
+------------------------------------------------------------------------+

When traffic routes through a secure VPN interface, raw IP packets remain invisible to the Wi-Fi driver:

1. Every packet is encapsulated inside an authenticated UDP datagram using ChaCha20-Poly1305.
2. The Poly1305 authentication tag covers both ciphertext and associated transport headers.
3. If an attacker injects a rogue frame via FragAttacks, the packet enters the operating system outside the VPN tunnel context.

Because the host routing table enforces strict interface binding, injected packets cannot access sessions bound to the VPN virtual adapter.

RiceGuard Transport Defense: Neutralizing Malicious Sub-Frames at the Kernel Layer

VPNRice incorporates RiceGuard, an optimized WireGuard transport engineered to withstand Layer 2 radio compromises:

1. Cryptographic Tag Verification: Every RiceGuard datagram requires a 16-byte Poly1305 authentication tag calculated with ephemeral keys. Injected FragAttack frames lack this tag and are dropped at line rate by the kernel.
2. Socket Interface Isolation: RiceGuard binds DNS lookups and sockets strictly to virtual interface rg0. Injected frames on physical adapter wlan0 cannot alter DNS state or hijack active sockets.
3. Strict Policy Routing Rules: By maintaining isolated routing tables (such as table 51820), RiceGuard prevents unencapsulated packets from escaping through physical interfaces, avoiding failures seen in DHCP Option 121 route injection attacks.

Users can verify connection security and external routing integrity using our What is my IP tool.

Benchmarking Packet Integrity: Fragmentation Overhead, Jitter, and Rejection Rates

We evaluated resiliency under active FragAttack injection in an isolated wireless testbed. A rogue node transmitted fragmented A-MSDU frames using software-defined radios, attempting to inject DNS responses and TCP resets.

We benchmarked three configurations: an unprotected WPA2 connection, an unencrypted open hotspot, and an active RiceGuard encrypted tunnel.

On standard WPA2 connections, vulnerable drivers accepted injected frames, resulting in cache poisoning and socket corruption.

Under RiceGuard, the operating system kernel rejected unauthenticated frames at the packet filter boundary, preserving connection integrity with negligible latency impact.

Practical Hardening: Inspecting Wi-Fi Frame Reassembly and Securing Mobile Devices

Users operating in wireless environments can take concrete steps to strengthen endpoint security against frame injection.

Auditing Wi-Fi Driver Configuration on Linux

On Linux systems, inspect wireless interface settings and frame reassembly:

# Check current wireless interface capabilities and fragmentation settings
iw dev wlan0 info

# Inspect packet counters for dropped malformed frames
ip -s link show wlan0

# Monitor wireless frames for unusual aggregation flags
sudo tcpdump -ni wlan0 -e -s 0 "type data and subtype qos-data" -v

Disabling Aggregation on Hostile Networks

In high-risk deployments on untrusted hardware, administrators can temporarily disable A-MSDU aggregation:

# Example for Intel wireless drivers: disable hardware aggregation
sudo modprobe -r iwlwifi
sudo modprobe iwlwifi 11n_disable=1

While disabling aggregation reduces peak wireless throughput, it eliminates hardware aggregation vulnerabilities. When users establish an encrypted tunnel using the official VPNRice client application, transport protections operate continuously in the background.

By enforcing authenticated Layer 3 encapsulation, modern endpoints preserve confidentiality and data integrity across untrusted wireless networks.