CVE-2020-26141: Medium severity ALFA Awus036h Firmware Windows 10 vulnerability
A vulnerability was found in Linux Kernel's Wi-Fi implementation. An attacker within wireless range can inject a control packet fragment where the kernel does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames.
Upstream patch: https://lore.kernel.org/linux-wireless/20210511180259.159598-1-johannes@sipsolutions.net/ https://lore.kernel.org/linux-wireless/20210511200110.c3f1d42c6746.I795593fcaae941c471425b8c7d5f7bb185d29142@changeid/
Other sources
A vulnerability was found in Linux kernel's WiFi implementation. An attacker within wireless range can inject a control packet fragment where the kernel does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames.
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.rt7.130.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-348.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.13 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
android/platform/vendor/qcom-opensource/wlan/qcacld-3.0to a version that resolves this vulnerability.Fixed in SoCVersion:2021-10-05 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 4.4.0-1103.108 - Upgrade
Upgrade
ubuntu/linux-lts-xenialto a version that resolves this vulnerability.Fixed in 4.4.0-223.256~14.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 4.4.0-223.256 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 4.4.0-1139.153 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 4.4.0-1104.113 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 4.4.0-1073.79 - Upgrade
Upgrade
ubuntu/linux-aws-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1051.53~18.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1051.53~18.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1046.49~18.04.1 - Upgrade
Upgrade
ubuntu/linux-gke-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1046.48~18.04.1 - Upgrade
Upgrade
ubuntu/linux-gkeop-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1018.19~18.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-77.86~18.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1048.52~18.04.1 - Upgrade
Upgrade
ubuntu/linux-raspi-5.4to a version that resolves this vulnerability.Fixed in 5.4.0-1038.41~18.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.4.0-77.86 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.4.0-1051.53 - Upgrade
Upgrade
ubuntu/linux-aws-5.8to a version that resolves this vulnerability.Fixed in 5.8.0-1038.40~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.4.0-1051.53 - Upgrade
Upgrade
ubuntu/linux-azure-5.8to a version that resolves this vulnerability.Fixed in 5.8.0-1036.38~20.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.4.0-1013.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.4.0-1046.49 - Upgrade
Upgrade
ubuntu/linux-gcp-5.8to a version that resolves this vulnerability.Fixed in 5.8.0-1035.37~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.4.0-1046.48 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.4.0-1018.19 - Upgrade
Upgrade
ubuntu/linux-hwe-5.8to a version that resolves this vulnerability.Fixed in 5.8.0-59.66~20.04.1 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.4.0-1041.42 - Upgrade
Upgrade
ubuntu/linux-oem-5.10to a version that resolves this vulnerability.Fixed in 5.10.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.4.0-1048.52 - Upgrade
Upgrade
ubuntu/linux-oracle-5.8to a version that resolves this vulnerability.Fixed in 5.8.0-1033.34~20.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 5.4.0-1038.41 - Upgrade
Upgrade
ubuntu/linux-riscv-5.8to a version that resolves this vulnerability.Fixed in 5.8.0-29.31~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.123~20.04.1 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1069.73+fips2 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1073.76+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1028.32 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.4.0-1067.71~20.04.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-26141?
CVE-2020-26141 has been rated as Medium severity due to its potential for exploitation within local network environments.
How do I fix CVE-2020-26141?
To fix CVE-2020-26141, update to the appropriate patched kernel versions as specified by your Linux distribution.
What systems are affected by CVE-2020-26141?
CVE-2020-26141 affects various Linux kernel versions, particularly those using the kernel-rt and kernel packages from Red Hat.
Can CVE-2020-26141 be exploited remotely?
No, CVE-2020-26141 requires the attacker to be within wireless range to exploit the vulnerability.
What kind of vulnerability is CVE-2020-26141?
CVE-2020-26141 is a network vulnerability in the Linux kernel's Wi-Fi implementation related to message integrity checks in TKIP frames.