CVE-2019-5108

Linux kernel

HIGH 7.4

En bref

Source: NVD
EPSS: EPSS 10.11 % · centile 96 (2026-10-28)
État: PUBLISHED
Publiée: 2019-12-23 18:55 UTC
Mise à jour: 2024-08-04 19:47 UTC
Attribuée par: talos
Statut NVD: Modified

Description

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

Faiblesses (CWE)

CWE-440 — Expected Behavior Violation
CWE-287 — Authentification incorrecte

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.0	HIGH 7.4	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	talos
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.0	HIGH 7.4	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	NVD · talos-cna@cisco.com (Secondary)
CVSS 2.0	LOW 3.3	AV:A/AC:L/Au:N/C:N/I:N/A:P	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2019-14713
GCVE · GCVE-0-2019-5108

Avis du CERT-FR

CERTFR-2020-AVI-483 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2020-AVI-368 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
CERTFR-2020-AVI-318 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2020-AVI-230 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
CERTFR-2020-AVI-195 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2020-AVI-186 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
CERTFR-2020-AVI-096 — Multiples vulnérabilités dans le noyau linux d'Ubuntu · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* < 5.3
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* ≥ 11.0.0 ≤ 11.70.1
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Linux kernel	affected Linux 4.14.98-v7+

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD