CVE-2019-5108
published 2019-12-23CVE-2019-5108: An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP…
PriorityP338medium6.5CVSS 3.1
AVAACLPRNUINSUCNINAH
EPSS
10.11%
95.1th percentile
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 5.3.7-1 (bookworm) | linux 5.3.7-1 (bookworm) |
| linux | linux_kernel | < 5.3 | 5.3 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 5.3.7-1 | 5.3.7-1 |
| linux | linux_kernel | >= 0 < 4.4.0-174.204 | 4.4.0-174.204 |
| linux | linux_kernel | >= 0 < 4.15.0-88.88 | 4.15.0-88.88 |
| netapp | e-series_santricity_os_controller | 11.0.0 – 11.70.1 | — |
| oracle | sd-wan_edge | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.4HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv2.03.3LOWAV:A/AC:L/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that a race condition existed in the Softmac USB Prism54
device driver in the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash). (CVE-2019-15220)
Julien Grall discovered that the Xen balloon memory driver in the Linux
kernel did not properly restrict the amount of memory set aside for page
mappings in some situations. An attacker could use this to cause a denial
of service (kernel memory exhaustion)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that the Atheros 802.11ac wireless USB device driver in
the Linux kernel did not properly validate device metadata. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2019-15099)
It was discovered that the HSA Linux kernel driver for AMD GPU devices did
not properly check for errors in certain situations, leading to a NULL
pointer dereference. A local attacker could possibly use this to cause a
denial of ser
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-4287-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
kernel for Microsoft Azure Cloud systems for Ubuntu 14.04 ESM.
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that the Atheros 802.11ac wireless USB device driver in
the Linux kernel did not properly validate device metadata. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2019-15099)
It was discovered that t
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that the HSA Linux kernel driver for AMD GPU devices did
not properly check for errors in certain situations, leading to a NULL
pointer dereference. A local attacker could possibly use this to cause a
denial of service. (CVE-2019-16229)
It was discovered that the Marvell 8xxx Libertas WLAN device driver in the
Linux kernel did not properly check for errors in certain situations,
leading to a NULL pointer dereference. A local attacker could possibly use
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-4286-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that a race condition existed in the Softmac USB Prism54
device driver in the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash). (CVE-2019-15220)
Julien Grall discovered that
Red Hat
kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS
vendor_redhat·2019-12-11·CVSS 6.5
CVE-2019-5108 [MEDIUM] CWE-440 kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS
kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.
A flaw was found in the Linux kernel’s implementation of the WiFi station hando
Debian
CVE-2019-5108: linux - An exploitable denial-of-service vulnerability exists in the Linux kernel prior ...
vendor_debian·2019·CVSS 6.5
CVE-2019-5108 [MEDIUM] CVE-2019-5108: linux - An exploitable denial-of-service vulnerability exists in the Linux kernel prior ...
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.
Scope: local
bookworm: resolved (fixed in 5.3.7-1)
bullseye: resolved (fixed in 5.3.7-1)
forky: resolved (fixed in 5.3.7-1)
sid: resolved (fixed in 5.3.7-1)
trixie: resolved (fixed in 5.3.7-1)
GHSA
GHSA-m32p-568p-hpc9: An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5
ghsa_unreviewed·2022-05-24
CVE-2019-5108 [LOW] CWE-20 GHSA-m32p-568p-hpc9: An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-gke-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that the Atheros 802.11ac wireless USB device driver in
the Linux kernel did not properly validate device metadata. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2019-15099)
It was discovered that the HSA Linux kernel driver for AMD GPU devices did
not properly check for errors in certain situations, leading to a NULL
pointer dereference. A local att
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that a race condition existed in the Softmac USB Prism54
device driver in the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash). (CVE-2019-15220)
Julien Grall discovered that the Xen balloon memory driver in the Linux
kernel did not properly restrict the amount of memory set aside for page
mappings in some situations. An attacker could use this to cause a denial
of service (kernel memory exhaustion). (CVE-2019-17351)
It was
OSV
linux-azure vulnerabilities
osv·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] linux-azure vulnerabilities
linux-azure vulnerabilities
USN-4287-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
kernel for Microsoft Azure Cloud systems for Ubuntu 14.04 ESM.
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that the Atheros 802.11ac wireless USB device driver in
the Linux kernel did not properly validate device metadata. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2019-15099)
It was discovered that the HSA Linux kernel driver for AMD GPU devices did
not properly check for errors i
OSV
linux-lts-xenial, linux-aws vulnerabilities
osv·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] linux-lts-xenial, linux-aws vulnerabilities
linux-lts-xenial, linux-aws vulnerabilities
USN-4286-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 ESM.
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that a race condition existed in the Softmac USB Prism54
device driver in the Linux kernel. A physically proximate attacker could
use this to cause a denial of service (system crash). (CVE-2019-15220)
Julien Grall discovered that the Xen balloon memory driver in the Linux
kernel did not properly rest
OSV
linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-oracle-5.0 vulnerabilities
osv·2020-02-18·CVSS 5.5
CVE-2019-14615 [MEDIUM] linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-oracle-5.0 vulnerabilities
linux-aws-5.0, linux-azure, linux-gcp, linux-gke-5.0, linux-oracle-5.0 vulnerabilities
It was discovered that the Linux kernel did not properly clear data
structures on context switches for certain Intel graphics processors. A
local attacker could use this to expose sensitive information.
(CVE-2019-14615)
It was discovered that the HSA Linux kernel driver for AMD GPU devices did
not properly check for errors in certain situations, leading to a NULL
pointer dereference. A local attacker could possibly use this to cause a
denial of service. (CVE-2019-16229)
It was discovered that the Marvell 8xxx Libertas WLAN device driver in the
Linux kernel did not properly check for errors in certain situations,
leading to a NULL pointer dereference. A local attacker could possibly use
this to cause a
OSV
CVE-2019-5108: An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5
osv·2019-12-23·CVSS 6.5
CVE-2019-5108 [MEDIUM] CVE-2019-5108: An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-5108 kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS
bugzilla·2020-01-10·CVSS 6.5
CVE-2019-5108 [MEDIUM] CVE-2019-5108 kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS
CVE-2019-5108 kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS
An exploitable denial-of-service vulnerability exists in the Linux kernel. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker within radio range can forge Authentication and Association Request packets to trigger this vulnerability.
Reference:
https://talosintelligence.com/vulnerability_reports/TALOS
Bugzilla
CVE-2019-5108 kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS [fedora-all]
bugzilla·2020-01-10·CVSS 6.5
CVE-2019-5108 [MEDIUM] CVE-2019-5108 kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS [fedora-all]
CVE-2019-5108 kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changel
Talos
Vulnerability Spotlight: Denial-of-service vulnerabilities in Linux kernel, W1.fi
blogs_talos·2019-12-11·CVSS 6.5
[MEDIUM] Vulnerability Spotlight: Denial-of-service vulnerabilities in Linux kernel, W1.fi
## Vulnerability Spotlight: Denial-of-service vulnerabilities in Linux kernel, W1.fi
Mitchell Frank and Mark Leonard of Cisco discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered two denial-of-service vulnerabilities in the open-source program W1.fi. Both of these vulnerabilities target hostapd. One could allow an attacker to forge authentication requests, while another could trigger a deauthentication, both resulting in a denial of service.
In accordance with our coordinated disclosure policy, Cisco Talos worked with the manager of W1.fi to ensure that these issues are resolved and that an update is available for affected customers. TALOS-2019-0849 relates to TALOS-2019-0900, a denial-of-service vulnerability in the Linux kernel. Linux has also release
Talos
Vulnerability Spotlight: Denial-of-service vulnerabilities in Linux kernel, W1.fi
blogs_talos·2019-12-11·CVSS 6.5
[MEDIUM] Vulnerability Spotlight: Denial-of-service vulnerabilities in Linux kernel, W1.fi
Mitchell Frank and Mark Leonard of Cisco discovered these vulnerabilities. Blog by Jon Munshaw.
Cisco Talos recently discovered two denial-of-service vulnerabilities in the open-source program W1.fi. Both of these vulnerabilities target hostapd. One could allow an attacker to forge authentication requests, while another could trigger a deauthentication, both resulting in a denial of service.
In accordance with our coordinated disclosure policy, Cisco Talos worked with the manager of W1.fi to ensure that these issues are resolved and that an update is available for affected customers. TALOS-2019-0849 relates to TALOS-2019-0900, a denial-of-service vulnerability in the Linux kernel. Linux has also released an update to address that vulnerability, which makes more versions of Linux besides
http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.htmlhttps://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7ehttps://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00012.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlhttps://security.netapp.com/advisory/ntap-20200204-0002/https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900https://usn.ubuntu.com/4285-1/https://usn.ubuntu.com/4286-1/https://usn.ubuntu.com/4286-2/https://usn.ubuntu.com/4287-1/https://usn.ubuntu.com/4287-2/https://www.debian.org/security/2020/dsa-4698https://www.oracle.com/security-alerts/cpuApr2021.htmlhttp://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.htmlhttps://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7ehttps://lists.debian.org/debian-lts-announce/2020/06/msg00011.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00012.htmlhttps://lists.debian.org/debian-lts-announce/2020/06/msg00013.htmlhttps://security.netapp.com/advisory/ntap-20200204-0002/https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900https://usn.ubuntu.com/4285-1/https://usn.ubuntu.com/4286-1/https://usn.ubuntu.com/4286-2/https://usn.ubuntu.com/4287-1/https://usn.ubuntu.com/4287-2/https://www.debian.org/security/2020/dsa-4698https://www.oracle.com/security-alerts/cpuApr2021.html
2019-12-23
Published