Bug in the latest Intel 8265 20.70.13.2 Windows driver during 802.1x authentication

[Lexy]

7297 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 34:e1:2d:8c:01:ef EAPOL-key M2 with invalid RSN IE received from mobile 34:e1:2d:8c:01:ef rxed IE len :86, 7298 rxed IE length in association:64 7299 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 34:e1:2d:8c:01:ef Dumping RSNIE received in Association request: 7300 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000000: 30 46 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 0F.............. 7301 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000010: 00 0f ac 03 3c 00 03 00 bb 11 c8 62 41 f6 d2 a7 ....<......bA... 7302 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000020: 0d 05 fa 41 d2 59 ec b5 bb 11 c8 62 41 f6 d2 a7 ...A.Y.....bA... 7303 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000030: 0d 05 fa 41 d2 59 ec b5 bb 11 c8 62 41 f6 d2 a7 ...A.Y.....bA... 7304 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 34:e1:2d:8c:01:ef Dumping RSNIE received in EAPOL M2 : 7305 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000000: 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ................ 7306 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000010: ac 03 3c 00 04 00 79 e5 31 8d 14 f3 d6 28 8d 15 ..<...y.1....(.. 7307 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000020: cd 21 84 82 e7 f8 bb 11 c8 62 41 f6 d2 a7 0d 05 .!.......bA..... 7308 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000030: fa 41 d2 59 ec b5 bb 11 c8 62 41 f6 d2 a7 0d 05 .A.Y.....bA..... 7309 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000040: fa 41 d2 59 ec b5 bb 11 c8 62 41 f6 d2 a7 0d 05 .A.Y.....bA..... 7310 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000050: fa 41 d2 59 ec b5 .A.Y.. 7311 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000000: 30 46 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 0F.............. 7312 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000010: 00 0f ac 03 3c 00 03 00 bb 11 c8 62 41 f6 d2 a7 ....<......bA... 7313 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000020: 0d 05 fa 41 d2 59 ec b5 bb 11 c8 62 41 f6 d2 a7 ...A.Y.....bA... 7314 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000030: 0d 05 fa 41 d2 59 ec b5 bb 11 c8 62 41 f6 d2 a7 ...A.Y.....bA... 7315 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000000: 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ................ 7316 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000010: ac 03 3c 00 04 00 79 e5 31 8d 14 f3 d6 28 8d 15 ..<...y.1....(.. 7317 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000020: cd 21 84 82 e7 f8 bb 11 c8 62 41 f6 d2 a7 0d 05 .!.......bA..... 7318 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000030: fa 41 d2 59 ec b5 bb 11 c8 62 41 f6 d2 a7 0d 05 .A.Y.....bA..... 7319 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000040: fa 41 d2 59 ec b5 bb 11 c8 62 41 f6 d2 a7 0d 05 .A.Y.....bA..... 7320 *Dot1x_NW_MsgTask_7: Nov 27 18:38:07.204: [PA] 00000050: fa 41 d2 59 ec b5 .A.Y..

After upgrading the driver on our laptops, we occasionally see the following errors in Cisco APs. Looks like a buffer overflow to me, as the RSN IE element is here without the header and twice. Sometimes I see it thrice.

It wasn't an issue with 20.70.11.3.

8023 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 34:e1:2d:8c:01:ef EAPOL-key M2 with invalid RSN IE received from mobile 34:e1:2d:8c:01:ef rxed IE len :54, 8024 rxed IE length in association:40 8025 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 34:e1:2d:8c:01:ef Dumping RSNIE received in Association request: 8026 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000000: 30 26 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 0&.............. 8027 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000010: 00 0f ac 03 3c 00 01 00 72 85 e6 36 32 91 75 c2 ....<...r..62.u. 8028 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000020: be 9b 36 8b 58 b6 49 29 ..6.X.I) 8029 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 34:e1:2d:8c:01:ef Dumping RSNIE received in EAPOL M2 : 8030 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000000: 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ................ 8031 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000010: ac 03 3c 00 02 00 08 dc ec 7f d7 10 da 54 45 e6 ..<..........TE. 8032 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000020: e4 59 df ba 9f 09 72 85 e6 36 32 91 75 c2 be 9b .Y....r..62.u... 8033 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000000: 30 26 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 0&.............. 8034 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000010: 00 0f ac 03 3c 00 01 00 72 85 e6 36 32 91 75 c2 ....<...r..62.u. 8035 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000020: be 9b 36 8b 58 b6 49 29 ..6.X.I) 8036 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000000: 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ................ 8037 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000010: ac 03 3c 00 02 00 08 dc ec 7f d7 10 da 54 45 e6 ..<..........TE. 8038 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000020: e4 59 df ba 9f 09 72 85 e6 36 32 91 75 c2 be 9b .Y....r..62.u... 8039 *Dot1x_NW_MsgTask_7: Nov 27 18:39:14.561: [PA] 00000030: 36 8b 58 b6 49 29 6.X.I)

[Wanner_G_Intel]

Hello Lexy,

Thank you for submitting your question on this Intel® Community.

To better assist you, please provide us with the following information.

• How is this issue affecting the laptops? How many devices are being impacted by this issue?
• Could you please provide us with the model numbers of the systems (laptops and APs) in question?
• If possible, please generate a system report with the Intel® System Support Utility (Intel® SSU) on one of the systems and attach it to this thread.

1. Intel® SSU Download link
2. Open the application and click on "Scan" to see the system and device information. By default, Intel® SSU will take you to the "Summary View".
3. Click on the menu where it says "Summary" to change to "Detailed View".
4. To save your scan, click on "Next", then "Save".

Wanner G.

Intel Customer Support Technician

A Contingent Worker at Intel

[Lexy]

Hello Wanner G.,

Thank you for your response.

• How is this issue affecting the laptops? How many devices are being impacted by this issue?

When the laptops roam around the office, they occasionally disconnect from WiFi and fail to reconnect for a minute or so. It affects about 15-20% of the fleet of ~400 machines.

• Could you please provide us with the model numbers of the systems (laptops and APs) in question?

The laptops are Lenovo X1 Carbon Gen 6 (type 20KG), Lenovo X1 Yoga Gen 3, Lenovo T470s running Windows 10 1709 and 1809.

The APs are Cisco AIR-AP-3802I-D-K9 and AIR-AP-3802I-E-K9.

• If possible, please generate a system report with the Intel® System Support Utility (Intel® SSU) on one of the systems and attach it to this thread.

Here it is.

[Wanner_G_Intel]

Hello Lexy,

Thank you for your response. 

We would like to look into this issue to better assist you.

Please provide us with the following details about the network configuration if available.

Wireless security method

Encryption Type (Open, RC4, TKIP, AES):

802.1X authentication type (WEP, TKIP, CCMP): 

Key Management Type (PEAP, EAP-FAST):

WiFi network environment

Access Point SW version:

Wireless Frequencies in use (2.4 and/or 5 GHz):

802.11n or 802.11ac enabled (None/HT(11n)/VHT(11ac)):  

Channel Width (20 MHz vs. 40 MHz) for 2.4 GHz?

Channel Width (20 MHz vs. 40 MHz vs. 80MHz) for 5 GHz?

SSID stealth mode (hidden or broadcast):

WLAN Controller manufacturer, model, and SW version:

WLAN controller log:

RADIUS Server Make/Version:

Windows System Event log

Feel free to send this information to us via private message. If you would like to email it, please let us know.

Wanner G.

Intel Customer Support Technician

A Contingent Worker at Intel

[Lexy]

Wireless security method

Encryption Type (Open, RC4, TKIP, AES):

AES

802.1X authentication type (WEP, TKIP, CCMP):

CCMP 

Key Management Type (PEAP, EAP-FAST):

EAP-TLS using machine certificates

WiFi network environment

Access Point SW version:

Wireless Frequencies in use (2.4 and/or 5 GHz):

Both

802.11n or 802.11ac enabled (None/HT(11n)/VHT(11ac)):  

VHT (11ac)

Channel Width (20 MHz vs. 40 MHz) for 2.4 GHz?

40

Channel Width (20 MHz vs. 40 MHz vs. 80MHz) for 5 GHz?

40

SSID stealth mode (hidden or broadcast):

Broadcast

WLAN Controller manufacturer, model, and SW version:

Cisco 8540 V8.2.170.0

WLAN controller log:

Can provide via email

RADIUS Server Make/Version:

Cisco ISE V2.3 IIRC

[Wanner_G_Intel]

Hello Lexy,

Thank you for your response. 

We have sent you an email to the email address associated with your profile to obtain the WLAN controller log. 

Please let us know if you receive it.

Wanner G.

Intel Customer Support Technician

A Contingent Worker at Intel

[Lexy]

Access point data:

AP Running Image    : 8.2.170.0

Primary Boot Image  : 8.2.170.0

Backup Boot Image   : 8.3.143.0

1 Multigigabit Ethernet interfaces

1 Gigabit Ethernet interfaces

2 802.11 Radios

Radio Driver version : 9.0.5.5-W8964

Radio FW version : 9.1.8.1

[Lexy]

And thank you, I have sent the WLC logs in reply.

[Wanner_G_Intel]

Hello Lexy,

Thank you for your response.

We will update this thread as soon as possible.

Wanner G.

Intel Customer Support Technician

A Contingent Worker at Intel

[Wanner_G_Intel]

Hello Lexy,

We would like to update this thread.

We are trying to work together with Cisco to investigate this issue.

Please open a support ticket with Cisco and share the case number with us. You can send a private message to us once you have the case number available. 

Wanner G.

Intel Customer Support Technician

A Contingent Worker at Intel

[Lexy]

SR 687719715| - Cisco case Regards, Lexy via mobile. Please excuse typos and style.

[Wanner_G_Intel]

Hello Lexy,

Thank you for your response.

We will update this thread as soon as possible.

Wanner G.

Intel Customer Support Technician

A Contingent Worker at Intel

[Lexy]

Dear Wanner G.,

Can you share an Intel case number and/or a direct contact for this issue? I would like to set up a joint call between Intel, Cisco, Microsoft and our organization to discuss the possible diagnostic and/or remediation activities.

Regards, Lexy

[Wanner_G_Intel]

Hello Lexy,

We are working on this issue. Regarding your request to have a joint call between Intel, Cisco, Microsoft and your organization, we will do research about this.

In the meantime, please keep checking with Cisco in case they have a solution on their end.

We also recommend that you continue using the driver version 20.70.11.3, which does not affect your system's performance. If a new driver version is released, please test it.

Wanner G.

Intel Customer Support Technician

A Contingent Worker at Intel

[Wanner_G_Intel]

Hello Lexy,

We would like to update this thread.

An ongoing investigation is taking place to address the issue reported on this thread. Basically, "clients fail to respond to M1 during EAPOL 4-Way Handshake" which is basically using 802.1x connection type. Intel is working with different AP vendors to fix this problem.

For reference purposes, here is the ticket that was opened with the engineering team: WIFI-34160. Our recommendation is that you continue working with your Cisco, since both Intel and your AP manufacturer are both working on this problem.

It is worth mentioning that some users can mitigate the problem by disabling Fast Transition (802.11R) at AP level. You may give it a try for testing purposes.

Wanner G.

Intel Customer Support Technician

A Contingent Worker at Intel

[Lexy]

Thank you, Wanner G. We have tried to disable 802.11r, but it didn’t help. The issue is present during fast roaming with OKC. Regards, Lexy