CVE-2020-24588 — Use of a Broken or Risky Cryptographic Algorithm in Linux
CWE-327 — Use of a Broken or Risky Cryptographic AlgorithmCWE-20 — Improper Input ValidationCWE-354 — Improper Validation of Integrity Check ValueCWE-345 — Insufficient Verification of Data AuthenticityCWE-772 — Missing Release of Resource after Effective LifetimeCWE-99 — Resource InjectionCWE-306 — Missing Authentication for Critical Function45 documents15 sources
Severity
9.1CRITICALNVD
NVD7.8NVD3.5OSV3.5
EPSS
0.3%
top 45.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 11
Latest updateAug 16
Description
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.1 | Impact: 1.4
Affected Packages26 packages
▶CVEListV5linux/linux79720743421753ff72bfa0d79976c534645b81c1 — e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80+5
Also affects: Debian Linux 11.0, 9.0
🔴Vulnerability Details
19GHSA▶
GHSA-hxq3-8p4p-wv7w: In the Linux kernel, the following vulnerability has been resolved:
wifi: prevent A-MSDU attacks in mesh networks
This patch is a mitigation to prev↗2025-08-16
OSV▶
CVE-2025-38512: In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to preven↗2025-08-16