CVEvulnerability

CVE-2019-5108

6.5 MEDIUM Published 2019-12-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-12-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
7.4 HIGH — CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0 ([email protected])
3.3 LOW — AV:A/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-287, CWE-440

Description

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

Affected configurations

• linux linux kernel (< 5.3) • debian debian linux 8.0 • debian debian linux 9.0 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • netapp active iq unified manager • netapp cloud backup • netapp data availability services • netapp e-series santricity os controller (>= 11.0.0 <= 11.70.1) • netapp hci management node • netapp solidfire • netapp steelstore cloud integrated storage • netapp a700s firmware • netapp h610s firmware • netapp 8300 firmware • netapp 8700 firmware • netapp a400 firmware • oracle sd-wan edge 8.2

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-440 Expected Behavior Violation weakness

References