The recent KRACK vulnerability has made me worried about taking my Pi out with me in public areas. I was wondering if the Raspian/Linux dist would of updated the WiFi driver automatically to protect from the vulnerability or do I need to do somthing like "sudo rpi-update" to do this.
Although initially pretty much everyone with a consumer device (Android, Windows, iOS, macOS, freeBSD...) was vulnerable to some form of exploit because of this, they've all, with one apparent unfortunate exception, patched it. I did not follow up on how successful this was.
The problem on GNU/Linux isn't with kernel code (which includes wifi driver stuff), or it would have been dealt with by now too. It's with a userspace tool used for handling the WPA(2) protocol,
wpa_supplicant(that thing you provide a password to in a configuration file). It apparently hasn't been updated in 19 months, which is when the last entry in their changelog is. But...
Before I get to that: The first point is relevant because it means the vast majority of targets aren't targets anymore -- presuming they've all been updated. I still think miscreants are more likely to be looking for vulnerable devices in that realm.
It looks (again, at a glance) to me like different systems fall prey to variants of the exploit, meaning someone would have to be targeting wpa_supplicant in particular.
I noticed this a while ago:
> stat $(which wpa_supplicant) File: /usr/sbin/wpa_supplicant Size: 2102264 Blocks: 4112 IO Block: 4096 regular file Device: 10307h/66311d Inode: 2239721 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2018-06-06 07:48:28.168440821 -0400 Modify: 2017-11-01 08:44:08.000000000 -0400 Change: 2017-11-11 07:44:55.499106515 -0500 Birth: -
That's on Fedora. Note the modify/change times.
> stat $(which wpa_supplicant) File: /sbin/wpa_supplicant Size: 1368104 Blocks: 2680 IO Block: 4096 regular file Device: b302h/45826d Inode: 2809 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2017-10-30 10:56:02.686072537 -0400 Modify: 2017-10-14 08:18:32.000000000 -0400 Change: 2017-10-30 10:56:02.686072537 -0400 Birth: -
That's on Debian; Raspbian will be the same and so will pretty much all other mainstream distros. The
wpa_supplicant executable was replaced a few weeks after the KRACK CVE's were published (Android, which also uses wpa_supplicant, was patched a bit less than a week after that according to the wikipedia page). Although that CVE was updated recently (implying no one may be out of the woods yet), the major issue would be people learning about the original problem because it was published online, but that is dealt with.
If you pop that CVE into the Debian security bug/fix tracker:
If you look at the bottom of that Debian security page, there is a link to patches dated in Oct 2017; the wpa supplicant update was at the end of that month -- you can relax now.