CVE-2019-5108

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-23 · updated 2026-06-17
Weakness: CWE-440

Description

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04
Debian Linux: 8.0, 9.0
Linux kernel: before 5.3 — fixed in 5.3
NetApp 8300 Firmware: all versions
NetApp 8700 Firmware: all versions
NetApp A400 Firmware: all versions
NetApp A700S Firmware: all versions
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Cloud Backup: all versions
NetApp Data Availability Services: all versions
E-Series SANtricity OS Controller Software 11.x: from 11.0.0 through 11.70.1
NetApp H610S Firmware: all versions
NetApp Hci Management Node: all versions
NetApp Solidfire: all versions
NetApp Steelstore Cloud Integrated Storage: all versions
Oracle Corporation SD-WAN Edge: 8.2

How to fix

Upgrade to a fixed version: Linux kernel 5.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-5108 or the next vulnerability affects your stack