CVE-2020-36516

Description

An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
• v2.0•MEDIUM•Score: 4.9AV:N/AC:M/Au:S/C:N/I:P/A:P

EPSS Trends

Current EPSS score: 0.04%• Percentile: 12%

Techniques & Countermeasures

• CWE-327•Use of a Broken or Risky Cryptographic Algorithm

  The product uses a broken or risky cryptographic algorithm or protocol.

Affected Systems

• linux•linux_kernel

  ≤ 5.6.11

• netapp•bootstrap_os

  na

• netapp•cloud_volumes_ontap_mediator

  na

• netapp•e-series_santricity_os_controller

  ≥ 11.0

• netapp•h300e

  na

• netapp•h300s_firmware

  na

• netapp•h410c_firmware

  na

• netapp•h410s_firmware

  na

• netapp•h500e

  na

• netapp•h500s_firmware

  na

• netapp•h610c_firmware

  na

• netapp•h610s_firmware

  na

• netapp•h615c_firmware

  na

• netapp•h700e

  na

• netapp•h700s_firmware

  na

• netapp•solidfire_\&_hci_management_node

  na

• netapp•solidfire\,_enterprise_sds_\&_hci_storage_node

  na

References (2)

• https://dl.acm.org/doi/10.1145/3372297.3417884
• https://security.netapp.com/advisory/ntap-20220331-0003/