CVE-2020-36516

What it actually does

The mixed IPID assignment method combined with hash-based policy produces predictable IPID values that allow an off-path attacker to guess TCP sequence numbers and inject data into or terminate an established session.

Why it matters to the business

Attackers can disrupt or tamper with network sessions across widely deployed Linux-based systems and storage appliances, leading to potential data integrity loss, session resets, and operational downtime in environments with high downstream usage.

How an attack unfolds

An off-path attacker passively observes network traffic to infer IPID patterns, then crafts spoofed packets that inject data or send RST segments to hijack or terminate a victim's TCP connection without direct path access.

How to fix it

Upgrade the Linux kernel to a version after 5.16.11 that corrects the IPID assignment policy; apply the corresponding vendor patches for all listed affected products including NetApp storage controllers and mediators.

How to confirm the fix worked

Confirm the running kernel version exceeds 5.16.11, re-test IPID predictability with network analysis tools, and verify that vendor-supplied updates are installed on all affected appliances.

Typical attack path

1. Observe target TCP session traffic from an off-path position
2. Predict IPID values using the mixed assignment weakness
3. Craft and inject spoofed TCP segments with guessed sequence numbers
4. Deliver data injection or session-terminating packets

How to detect it

Review network and system logs for sudden unexpected TCP session terminations or anomalous injected packets; correlate with off-path traffic patterns and monitor kernel-level connection state changes.

What your security team should do

• Apply kernel and vendor updates immediately given the broad ecosystem prevalence
• Restrict exposure of TCP services to trusted networks where possible
• Enable logging of unexpected TCP resets and session anomalies for ongoing monitoring