CVE-2020-24586

kernel: Fragmentation cache not cleared on reconnection

Published May 11, 2021 CVSS 3.1 · 3.5 Low EPSS 5.8% KEV · Not listed
Description
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2689-1 linux security update
Debian DLA Debian DLA DLA-2690-1 linux-4.19 security update
Debian DLA Debian DLA DLA-3380-1 firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
EUVD EUVD EUVD-2020-17303 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
Ubuntu USN Ubuntu USN USN-4997-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-4997-2 Linux kernel (KVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-4999-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5000-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5000-2 Linux kernel (KVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-5001-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-5018-1 Linux kernel vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 4, 2024, 3:19 PM
Reserved
Aug 21, 2020, 12:00 AM
Status
Modified
Published
May 11, 2021, 8:15 PM
Modified
Jun 17, 2026, 3:05 AM
Severity
Moderate
Public date
May 12, 2021, 1:20 AM