Vulnerability · Published May 11, 2021 · Assigned by mitre
CVE-2020-26144
Medium 6.5
In plain English
A medium-severity security flaw in the kernel-tools-libs-devel package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.9% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)4.9%top 7.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-348.el8 | ALSA-2021:4356 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2020-26144 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2020-26144 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-26144 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2020-26144 |
Affected products (as reported)
References
- 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021 vendor-advisory, x_refsource_CISCO
- https://www.fragattacks.com x_refsource_MISC
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md x_refsource_MISC
- [oss-security] 20210511 various 802.11 security issues - fragattacks.com mailing-list, x_refsource_MLIST
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf x_refsource_CONFIRM
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63 x_refsource_MISC
- https://cert-portal.siemens.com/productcert/html/ssa-913875.html
- https://cert-portal.siemens.com/productcert/html/ssa-019200.html