From the KRACK website:

In a key reinstallation attack, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying cryptographic handshake messages. When the victim reinstalls the key, associated parameters such as the incremental transmit packet number (i.e. nonce) and receive packet number (i.e. replay counter) are reset to their initial value. Essentially, to guarantee security, a key should only be installed and used once. Unfortunately, we found this is not guaranteed by the WPA2 protocol. By manipulating cryptographic handshakes, we can abuse this weakness in practice.

Unless a known patch has been applied, assume that all WPA2 enabled Wi-fi devices are vulnerable.

• Should a vendor take responsibility, devices are for the most part updatable.

• Many devices do not have an easy way to apply updates.
• A huge burden is placed on the consumer to keep their devices up to date
  • It may not be easy to search for all updates to all devices.
• The attack is works for both clients and access points
  • Updating an access point does not keep clients protected!

• Attacks against Android 6.0+ devices are very easy to accomplish.
  • It is advised to disable Wi-Fi and only use 4G for the time being.
• Updates may never come for many IoT devices.

• Adversary can decrypt arbitrary packets.
  • This allows an adversary to obtain the TCP sequence numbers of a connection, and hijack TCP connections.
• Adversary can replay broadcast and multicast frames.
• Adversary can both decrypt and inject arbitrary packets. (TKIP or GCMP ONLY)
• Adversary can force the client into using a predictable all-zero encryption key. (ANDROID 6.0+ and LINUX)

• Adversary can not recover WPA password.
• Adversary can not inject packets. (AES-CCMP ONLY)

• https://blog.cryptographyengineering.com/2017/10/16/falling-through-the-kracks/
• https://www.reddit.com/r/KRaCK/comments/76pjf8/krack_megathread_check_back_often_for_updated/