CVE-2020-36516 Other in n/a
An off-path attacker can inject data into or terminate a victim's TCP session due to flawed IPID assignment in the Linux kernel.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36516?
CVE-2020-36516 is a medium-severity vulnerability in Linux kernel, published on 26 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session.
Weakness: CWE-327
Which versions are affected by CVE-2020-36516?
It affects 17 products.
Linux distribution packages (3)
kgraft-patch-SLE12-SP5_Update_34 SUSE:Linux Enterprise Live Patching 12 SP5 | All versions | 2-2.2 |
kernel-livepatch-SLE15_Update_32 SUSE:Linux Enterprise Live Patching 15 | All versions | 2-150000.2.1 |
kernel-livepatch-SLE15-SP1_Update_33 SUSE:Linux Enterprise Live Patching 15 SP1 | All versions | 2-150100.2.1 |
Products include Linux kernel, Netapp Bootstrap Os, Netapp Cloud Volumes Ontap Mediator, Netapp E-Series Santricity Os Controller, Netapp H300e Firmware, Netapp H300s Firmware and 11 more.
How do I fix CVE-2020-36516?
Apply the vendor's patch.
Is CVE-2020-36516 being exploited?
There is no known exploitation of CVE-2020-36516 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2020-36516, GHSA-w52c-ppqw-2gxp, SUSE-SU-2022:3064-1, UBUNTU-CVE-2020-36516.