Log in Start free

Vulnerability · Published May 11, 2021 · Assigned by mitre

CVE-2020-26147

Medium 5.4

In plain English

A medium-severity security flaw in the kernel-tools-libs-devel package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.6% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)7.6%top 5.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8kernel-tools-libs-devel4.18.0-348.el8ALSA-2021:4356
Debian:12linux5.10.46-1DEBIAN-CVE-2020-26147
Debian:13linux5.10.46-1DEBIAN-CVE-2020-26147
Debian:14linux5.10.46-1DEBIAN-CVE-2020-26147
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2020-26147
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2020-26147
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2020-26147

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References