A vulnerability was found in Linux Kernel. Where the Wifi implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.

Upstream patch: https://lore.kernel.org/linux-wireless/20210511180259.159598-1-johannes@sipsolutions.net/

A flaw was found in the Linux kernels wifi implementation. An attacker connected to the wireless network can send 'authentication and key management' frames to any participant on the network. These frames are only intended to be sent from the controlling access point however the kernel did not prevent retransmission of these packets from non-controlling nodes.

Upstream fix: https://lore.kernel.org/linux-wireless/20210511200110.cb327ed0cabe.Ib7dcffa2a31f0913d660de65ba3c8aca75b1d10f@changeid/

A flaw was found in the Linux kernels wifi implementation. An attacker within wireless broadcast range can inject custom data into the wireless communication circumventing checks on the data. This can cause the frame to pass checks and be considered a valid frame of a different type.

A flaw was found in the Linux kernel's wifi implementation wherein an attacker within wireless range is able to abuse a logic flaw in the wifi implementation by reassembling packets from multiple fragments under different keys and they would be treated as valid. This allows an attacker to send a fragment under an incorrect key and be treated as a valid fragment under the new key.

Upstream patch: https://lore.kernel.org/linux-wireless/20210511200110.3f8290e59823.I622a67769ed39257327a362cfc09c812320eb979@changeid/

Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of an affected device. These vulnerabilities are due to insufficient validation of CAPWAP packets. An attacker could exploit these vulnerabilities by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to crash and reload, resulting in a DoS condition on the affected device.

A vulnerability in the packet processing functionality of Cisco Embedded Wireless Controller (EWC) Software for Catalyst Access Points (APs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected AP. This vulnerability is due to insufficient buffer allocation. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to exhaust available resources and cause a DoS condition on an affected AP, as well as a DoS condition for client traffic traversing the AP.