CVE-2019-5108

Linux kernel

HIGH 7.4

At a glance

Source: NVD
EPSS: EPSS 10.11 % · percentile 96 (2026-10-28)
State: PUBLISHED
Published: 2019-12-23 18:55 UTC
Updated: 2024-08-04 19:47 UTC
Assigner: talos
NVD status: Modified

Description

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

Weaknesses (CWE)

CWE-440 — Expected Behavior Violation
CWE-287 — Improper Authentication

References

Scores

Version	Score	Vector	Scored by
CVSS 3.0	HIGH 7.4	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	talos
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.0	HIGH 7.4	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	NVD · talos-cna@cisco.com (Secondary)
CVSS 2.0	LOW 3.3	AV:A/AC:L/Au:N/C:N/I:N/A:P	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2019-14713
GCVE · GCVE-0-2019-5108

CERT-FR advisories

CERTFR-2020-AVI-483 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2020-AVI-368 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
CERTFR-2020-AVI-318 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2020-AVI-230 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
CERTFR-2020-AVI-195 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2020-AVI-186 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2020-AVI-096 — Multiples vulnérabilités dans le noyau linux d'Ubuntu · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* < 5.3
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* ≥ 11.0.0 ≤ 11.70.1
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*

Affected products

Product	Versions
Linux kernel	affected Linux 4.14.98-v7+

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD