CVE-2020-26146

CVE Details

Release Date:	2021-05-11
Impact:	None	What is this?

Description

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.

See more information about CVE-2020-26146 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	5.3
Vector String:	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Version:	3.0
Attack Vector:	Adjacent_Network
Attack Complexity:	High
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	High
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (kernel-uek)	ELSA-2021-9459	2021-09-22
Oracle Linux version 7 (kernel-uek)	ELSA-2021-9459	2021-09-22
Oracle Linux version 8 (kernel)	ELSA-2021-4356	2021-11-16
Oracle VM version 3 (kernel-uek)	OVMSA-2021-0031	2021-09-22