CVE-2019-5108

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.
References
Link Resource
http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html Third Party Advisory VDB Entry
https://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7e Mailing List Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20200204-0002/ Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900 Exploit Third Party Advisory
https://usn.ubuntu.com/4285-1/ Third Party Advisory
https://usn.ubuntu.com/4286-1/ Third Party Advisory
https://usn.ubuntu.com/4286-2/ Third Party Advisory
https://usn.ubuntu.com/4287-1/ Third Party Advisory
https://usn.ubuntu.com/4287-2/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4698 Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch Third Party Advisory
http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html Third Party Advisory VDB Entry
https://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7e Mailing List Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20200204-0002/ Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900 Exploit Third Party Advisory
https://usn.ubuntu.com/4285-1/ Third Party Advisory
https://usn.ubuntu.com/4286-1/ Third Party Advisory
https://usn.ubuntu.com/4286-2/ Third Party Advisory
https://usn.ubuntu.com/4287-1/ Third Party Advisory
https://usn.ubuntu.com/4287-2/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4698 Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:8300:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:8700:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:a400:-:*:*:*:*:*:*:*

Configuration 10 (hide)

cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*

History

21 Nov 2024, 04:44

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html - Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html - Third Party Advisory, VDB Entry
References () https://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7e - Mailing List, Patch, Vendor Advisory () https://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7e - Mailing List, Patch, Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - Mailing List, Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20200204-0002/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20200204-0002/ - Third Party Advisory
References () https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900 - Exploit, Third Party Advisory () https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900 - Exploit, Third Party Advisory
References () https://usn.ubuntu.com/4285-1/ - Third Party Advisory () https://usn.ubuntu.com/4285-1/ - Third Party Advisory
References () https://usn.ubuntu.com/4286-1/ - Third Party Advisory () https://usn.ubuntu.com/4286-1/ - Third Party Advisory
References () https://usn.ubuntu.com/4286-2/ - Third Party Advisory () https://usn.ubuntu.com/4286-2/ - Third Party Advisory
References () https://usn.ubuntu.com/4287-1/ - Third Party Advisory () https://usn.ubuntu.com/4287-1/ - Third Party Advisory
References () https://usn.ubuntu.com/4287-2/ - Third Party Advisory () https://usn.ubuntu.com/4287-2/ - Third Party Advisory
References () https://www.debian.org/security/2020/dsa-4698 - Third Party Advisory () https://www.debian.org/security/2020/dsa-4698 - Third Party Advisory
References () https://www.oracle.com/security-alerts/cpuApr2021.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpuApr2021.html - Patch, Third Party Advisory

Information

Published : 2019-12-23 19:15

Updated : 2024-11-21 04:44


NVD link : CVE-2019-5108

Mitre link : CVE-2019-5108

CVE.ORG link : CVE-2019-5108


JSON object : View

Products Affected

netapp

  • h610s_firmware
  • cloud_backup
  • 8700
  • 8300_firmware
  • 8700_firmware
  • solidfire
  • 8300
  • data_availability_services
  • active_iq_unified_manager
  • e-series_santricity_os_controller
  • a700s
  • h610s
  • a400
  • a400_firmware
  • hci_management_node
  • steelstore_cloud_integrated_storage
  • a700s_firmware

linux

  • linux_kernel

debian

  • debian_linux

canonical

  • ubuntu_linux

oracle

  • sd-wan_edge
CWE
CWE-440

Expected Behavior Violation

CWE-287

Improper Authentication