Vulnerability · Published May 11, 2021 · Assigned by mitre
CVE-2020-26146
Medium 5.3
In plain English
A medium-severity improper input validation in the kernel-tools-libs-devel package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.6% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)5.6%top 7.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-348.el8 | ALSA-2021:4356 |
| Ubuntu:22.04:LTS | linux | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:25.10 | linux | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.10 | linux | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-aws | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-aws | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:25.10 | linux-aws | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-aws | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.10 | linux-aws | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-aws-6.14 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-aws-6.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-aws-6.2 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-aws-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-aws-7.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-azure | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:25.10 | linux-azure | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-azure | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.10 | linux-azure | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-6.11 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-6.14 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-6.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-azure-6.2 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-azure-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-7.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:25.10 | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.10 | linux-azure-fde | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-fde-6.14 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-fde-6.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-fde-7.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-nvidia | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-azure-nvidia-6.14 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-gcp | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-gcp | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:25.10 | linux-gcp | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-gcp | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.10 | linux-gcp | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-gcp-6.11 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-gcp-6.14 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-gcp-6.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-gcp-7.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-gke | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-gke | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-gke | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-gkeop | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-gkeop | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-hwe-6.11 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-hwe-6.14 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-hwe-6.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-hwe-7.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-ibm | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-ibm | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-ibm | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-ibm-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-intel | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-intel-iotg | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-kvm | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-lowlatency | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-lowlatency | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-lowlatency-hwe-6.11 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-nvidia | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-nvidia | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-nvidia | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-nvidia-6.11 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-nvidia-6.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-nvidia-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-nvidia-7.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-nvidia-bos | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-nvidia-lowlatency | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-nvidia-tegra | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-oem-6.11 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-oem-6.14 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-oem-6.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-oem-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-oem-7.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-oracle | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-oracle | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:25.10 | linux-oracle | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-oracle | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.10 | linux-oracle | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-oracle-6.14 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-oracle-6.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-oracle-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-oracle-7.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-raspi | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-raspi | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:25.10 | linux-raspi | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-raspi | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.10 | linux-raspi | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:25.10 | linux-realtime | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.10 | linux-realtime | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:25.10 | linux-riscv | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:26.10 | linux-riscv | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-riscv-6.14 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-riscv-6.17 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-riscv-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-riscv-6.8 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-riscv-7.0 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-starfive-6.5 | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-vmware | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:24.04:LTS | linux-xilinx | no fix listed | UBUNTU-CVE-2020-26146 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | no fix listed | UBUNTU-CVE-2020-26146 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021 vendor-advisory, x_refsource_CISCO
- https://www.fragattacks.com x_refsource_MISC
- https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md x_refsource_MISC
- [oss-security] 20210511 various 802.11 security issues - fragattacks.com mailing-list, x_refsource_MLIST
- https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf x_refsource_CONFIRM
- https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63 x_refsource_MISC
- https://cert-portal.siemens.com/productcert/html/ssa-913875.html
- https://cert-portal.siemens.com/productcert/html/ssa-019200.html