CVE-2019-18282
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.9%
The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.
Produtos afetados
n/a · n/aReferências
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.10https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=55667441c84fa5e0911a0aac44fb059c15ba6da2https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlhttps://security.netapp.com/advisory/ntap-20200204-0002/https://www.computer.org/csdl/proceedings-article/sp/2020/349700b594/1j2LgrHDR2o