CVE-2020-3702: 
Linux Kernel vulnerability analysis and mitigation

CVE-2020-3702 is a vulnerability discovered in the Atheros IEEE 802.11n family of chipsets (ath9k) that affects WLAN devices. The vulnerability allows specifically timed and handcrafted traffic to cause internal errors that lead to improper layer 2 Wi-Fi encryption, potentially resulting in information disclosure over the air for a discrete set of traffic. This vulnerability affects various Snapdragon platforms including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables, and Wired Infrastructure and Networking components (NVD).

The vulnerability has a CVSS v3.1 Base Score of 6.5 (MEDIUM) with a vector of CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue specifically affects WPA2 or WPA/WPA2 mixed-mode encryption standards when traffic is bridged using the 2.4GHz radio of affected Access Points. Under certain conditions, APs may temporarily transmit Wi-Fi traffic without encryption, though traffic encrypted at higher layers (e.g., TLS) remains secure (Arista Advisory).

The vulnerability can lead to information disclosure over the air for specific traffic patterns. When exploited, it allows attackers to potentially intercept unencrypted wireless network traffic, though any traffic that is encrypted at higher layers by edge devices remains protected (Arista Advisory).

The vulnerability requires specific conditions to be exploitable: the AP must be using WPA2 or WPA/WPA2 mixed-mode security standards, the Wi-Fi traffic must be bridged using the 2.4GHz radio, and the Access Point model must be among the affected platforms. The attack requires network adjacency but no special privileges or user interaction (Arista Advisory).

Several mitigation options are available: 1) Disable the 2.4GHz band of the SSID(s) on affected Access Points, though this will affect single-band devices that operate only in the 2.4GHz band. 2) Implement encryption at the application layer (e.g., TLS) for edge devices. 3) Upgrade to remediated software versions including AP Build versions 8.8.1-116-vv5, 8.8.2-49-vv4, or 8.8.3-12-vv3 (Arista Advisory, Debian Advisory).