Lucene search

[email protected]CVE-2019-5108

HistoryDec 23, 2019 - 7:15 p.m.

CVE-2019-5108

2019-12-2319:15:11

CWE-287

CWE-440

[email protected]

web.nvd.nist.gov

348

cve-2019-5108

linux kernel

denial-of-service

vulnerability

iapp

authentication

cam table attacks

3.3 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.9%

JSON

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

Affected configurations

NVD

Node

linuxlinux_kernelRange<5.3

Node

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

Node

canonicalubuntu_linuxMatch14.04esm

canonicalubuntu_linuxMatch16.04esm

canonicalubuntu_linuxMatch18.04lts

Node

netappactive_iq_unified_managerMatch-vmware_vsphere

netappcloud_backupMatch-

netappdata_availability_servicesMatch-

netappe-series_santricity_os_controllerRange11.0.0–11.70.1

netapphci_management_nodeMatch-

netappsolidfireMatch-

netappsteelstore_cloud_integrated_storageMatch-

Node

netappa700s_firmwareMatch-

AND

netappa700sMatch-

Node

netapph610s_firmwareMatch-

AND

netapph610sMatch-

Node

netapp8300_firmwareMatch-

AND

netapp8300Match-

Node

netapp8700_firmwareMatch-

AND

netapp8700Match-

Node

netappa400_firmwareMatch-

AND

netappa400Match-

Node

oraclesd-wan_edgeMatch8.2

CPENameOperatorVersion
linux:linux_kernellinux linux kernellt5.3

CPE	Name	Operator	Version
linux:linux_kernel	linux linux kernel	lt	5.3

CNA Affected

[
  {
    "product": "Linux kernel",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Linux 4.14.98-v7+"
      }
    ]
  }
]