Bug 1188528 (CVE-2020-26140)

Summary:	VUL-0: CVE-2020-26140: kernel-source: WiFi accepting plaintext data frames in protected networks
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Wolfgang Frisch <wolfgang.frisch>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED DUPLICATE	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P5 - None	CC:	smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/284052/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Wolfgang Frisch 2021-07-20 16:11:23 UTC

CVE-2020-26140

A vulnerability was found in Linux Kernel. Where the Wifi implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.

Upstream patch:
https://lore.kernel.org/linux-wireless/20210511180259.159598-1-johannes@sipsolutions.net/

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1960490
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26140
http://seclists.org/oss-sec/2021/q2/126
http://www.openwall.com/lists/oss-security/2021/05/11/12
https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26140
https://www.fragattacks.com

Comment 1 Wolfgang Frisch 2021-07-20 16:13:48 UTC

Duplicate of the FragAttacks bug.

*** This bug has been marked as a duplicate of bug 1185863 ***