LINUX SECURITY VULNERABILITY RESPONSE INFORMATION

Wi-Fi WPA/WPA2 Security Protocol Vulnerability [a.k.a. KRACK]

Wind River® is committed to delivering secure, reliable products that keep your devices protected. As part of this commitment, our Security Response Team is constantly monitoring and assessing thousands of notifications from CERT-accepted authorities and agencies, Linux security communities such as oss-security, and our customers. Wind River prioritizes these notifications, responds, and proactively contacts customers for timely alerts, enabling them to secure their devices.

Affected Products

The latest reported Wi-Fi WPA/WPA2 security protocol vulnerability, also referred to as KRACK, has been addressed by the Security Response Team. These vulnerabilities affect nearly all recent Wi-Fi implementations.

KRACK is tracked under the CVE entries:

We have determined that some Wind River products are affected, including the following:

  • VxWorks
  • Wind River Linux
  • Wind River Intelligent Device Platform
  • Wind River Pulsar Linux

Customers not on the latest version of software may be vulnerable and should contact Wind River Customer Support or their local Wind River representative for information regarding a fix for their version.

REMEDIATION

The following is a list of Wind River products and their vulnerability to the Wi-Fi WPA/WPA2 security protocol vulnerability (a.k.a. KRACK). For versions of products not listed, please contact Wind River Customer Support or your Wind River sales representative.

Product

Vulnerable

Version

Details**

VxWorks
Yes
6.5, 6.6, 6.7, 6.8, 6.9, 7
Please see the Wind River security notice at https://knowledge.windriver.com/Content_Lookup?id=K-511282
Note: VxWorks versions prior to 6.5 are not vulnerable
Wind River Linux
Yes
5, 6, 7, 8, 9
Please see the Wind River security notice at https://knowledge.windriver.com/Content_Lookup?id=K-511283
Wind River Pulsar Linux
Yes
7, 8
Please see the Wind River security notice at https://knowledge.windriver.com/Content_Lookup?id=K-511284
Wind River Intelligent Device Platform
Yes
All
Please see the Wind River security notice at https://knowledge.windriver.com/Content_Lookup?id=K-511283
Wind River Intelligent Device Platform XT
Yes
3.1
Please see the Wind River security notice at https://knowledge.windriver.com/Content_Lookup?id=K-511283
Wind River Titanium Cloud
No
All
Wind River Titanium Server
No
All
Wind River Hypervisor
No
All
Wind River VxWorks MILS Platform
No
All
Wind River VxWorks 653 Platform
No
All
Wind River VxWorks Cert Platform
No
All
Wind River Simics
No
All
Wind River Helix Device Cloud
No
All
Wind River Helix CarSync
No
All
** You need an account to access the Knowledge Library. If you don't have a valid Knowledge Library account, please contact local customer support.

We continue to monitor the situation on our security mailing lists in case there are new developments, and will post periodic updates via RSS feeds and the Wind River Support Network.

http://www.windriver.com/feeds/wrlinux_900.xml
http://www.windriver.com/feeds/wrlinux_800.xml
http://www.windriver.com/feeds/wrlinux_700.xml

You Can’t Afford a Security Breach

This is just one of the more than 6,000 security vulnerabilities that our Security Response Team analyzes annually, and only one of the more than 1,000 annually for which we have produced a fix and rolled it out to all of our current customers.

Our support and maintenance practices and processes provide the most tangible proof of value when choosing Wind River products.
Learn more about Wind River Security practices at www.windriver.com/products/linux/security.

Customers are urged to keep their support and maintenance contracts current, and to install the latest available updates to their installed products. If you don’t know if your support and maintenance contract is current, make sure to contact your Wind River representative.