CVE-2019-18282
Summary
| CVE | CVE-2019-18282 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-01-16 16:15:00 UTC |
|---|
| Updated | 2022-04-18 15:48:00 UTC |
|---|
| Description | The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| kernel/git/stable/linux.git - Linux kernel stable tree |
CONFIRM |
git.kernel.org |
Mailing List, Patch, Vendor Advisory |
| January 2020 Linux Kernel Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| [SECURITY] [DLA 2114-1] linux-4.9 security update |
MLIST |
lists.debian.org |
|
| cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.10 |
MISC |
cdn.kernel.org |
Mailing List, Vendor Advisory |
| CSDL | IEEE Computer Society |
MISC |
www.computer.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 376077 F5 BIG-IP Access Policy Manager (APM), Application Security Manager (ASM), Local Traffic Manager (LTM) Linux kernel Vulnerability (K32380005)
