PT-2020-6614 · Linux+8 · Linux Kernel+8
Published
2020-05-11
·
Updated
2023-11-09
·
CVE-2020-36516
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.16.11
Description
The issue is related to the mixed IPID assignment method with the hash-based IPID assignment policy in the Linux kernel, allowing an off-path attacker to inject data into a victim's TCP session or terminate that session. This can also lead to a man-in-the-middle attack due to insufficient cleaning of special elements in the output used by the incoming component.
Recommendations
For Linux kernel versions prior to 5.16.11, update to a version 5.16.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the TCP session to minimize the risk of exploitation. Avoid using the vulnerable IPID assignment method until the issue is resolved.
Fix
Special Elements Injection
Use of a Broken Cryptographic Algorithm
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linux Kernel
Red Hat
Rocky Linux
Suse
Ubuntu