kernel: reassembling encrypted fragments with non-consecutive packet numbers

A vulnerability was found in Linux kernel, where the WiFi implementation reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP...

kernel: reassembling mixed encrypted/plaintext fragments

A flaw was found in ieee80211rxhdefragment in net/mac80211/rx.c in the Linux Kernel's WiFi implementation. This vulnerability can be abused to inject packets or exfiltrate selected fragments when another device sends fragmented frames, and the WEP, CCMP, or GCMP data-confidentiality protocol is...

kernel: not verifying TKIP MIC of fragmented frames

A vulnerability was found in Linux kernel's WiFi implementation. An attacker within wireless range can inject a control packet fragment where the kernel does not verify the Message Integrity Check authenticity of fragmented TKIP frames...

kernel: reassembling mixed encrypted/plaintext fragments

A flaw was found in ieee80211rxhdefragment in net/mac80211/rx.c in the Linux Kernel's WiFi implementation. This vulnerability can be abused to inject packets or exfiltrate selected fragments when another device sends fragmented frames, and the WEP, CCMP, or GCMP data-confidentiality protocol is...

kernel: not verifying TKIP MIC of fragmented frames

A vulnerability was found in Linux kernel's WiFi implementation. An attacker within wireless range can inject a control packet fragment where the kernel does not verify the Message Integrity Check authenticity of fragmented TKIP frames...

kernel: Fragmentation cache not cleared on reconnection

A flaw was found in the Linux kernels implementation of wifi fragmentation handling. An attacker with the ability to transmit within the wireless transmission range of an access point can abuse a flaw where previous contents of wifi fragments can be unintentionally transmitted to another device...

kernel: Reassembling fragments encrypted under different keys

A flaw was found in the Linux kernel's WiFi implementation. An attacker within the wireless range can abuse a logic flaw in the WiFi implementation by reassembling packets from multiple fragments under different keys, treating them as valid. This flaw allows an attacker to send a fragment under a...

kernel: reassembling encrypted fragments with non-consecutive packet numbers

A vulnerability was found in Linux kernel, where the WiFi implementation reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP...

Oracle Linux 7 / 8 : olcne (ELSA-2021-9525)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9525 advisory. - Update Istio to 1.9.8 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781 - Bump release, addresses the...

Zephyr Number Error Vulnerability

Zephyr is an open source, small, scalable real-time operating system. Zephyr suffers from a numeric error vulnerability that stems from the reorganization header removal of Zephyr's integer downstream fragment in IEEE 802154. No detailed vulnerability details are provided at this time...

Zephyr null pointer dereference vulnerability (CNVD-2021-95622)

Zephyr is a small real-time operating system for connected, resource-constrained embedded devices. A null pointer dereference vulnerability exists in Zephyr 2.4.0 and later versions that can be exploited by an attacker to cause a denial of service by sending a malformed IEEE 802154 fragment...

CVE-2021-3322

Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions = =2.4.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3...

CVE-2021-3322

Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions = =2.4.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3...

CVE-2021-3330

RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr. Zephyr versions = =2.4.0 contain Out-of-bounds Write CWE-787. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj4r-373f-9456...

CVE-2021-3321

Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions = =2.4.0 contain Integer Overflow to Buffer Overflow CWE-680. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99...

CVE-2021-3321

Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions = =2.4.0 contain Integer Overflow to Buffer Overflow CWE-680. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99...

CVE-2021-3322

Zephyr RTOS exposes CVE-2021-3322 affecting 2.4.0 and later versions due to an unexpected pointer aliasing in IEEE 802154 fragment reassembly that can trigger a NULL pointer dereference (CWE-476). The vulnerability can lead to denial of service, with the CNVD entry explicitly mentioning a DoS con...

CVE-2021-3322 Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr

Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr. Zephyr versions = =2.4.0 contain NULL Pointer Dereference CWE-476. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p86r-gc4r-4mq3...

CVE-2021-3321 Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal

Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions = =2.4.0 contain Integer Overflow to Buffer Overflow CWE-680. For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99...

PT-2021-20090 · Zephyr · Zephyr

Name of the Vulnerable Software and Affected Versions: Zephyr versions 2.4.0 and later Description: The issue is related to unexpected pointer aliasing in IEEE 802154 fragment reassembly in Zephyr, which contains a NULL pointer dereference. Recommendations: For Zephyr versions 2.4.0 and later, at...