CVE-2020-26147

kernel: reassembling mixed encrypted/plaintext fragments

Published May 11, 2021 CVSS 3.1 · 5.4 Medium EPSS 7.6% KEV · Not listed
Description
An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2689-1 linux security update
Debian DLA Debian DLA DLA-2690-1 linux-4.19 security update
EUVD EUVD EUVD-2020-18774 An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
Ubuntu USN Ubuntu USN USN-4997-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-4997-2 Linux kernel (KVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-4999-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5000-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5000-2 Linux kernel (KVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-5001-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-5018-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5299-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-5343-1 Linux kernel vulnerabilities