CVEvulnerability

CVE-2019-18282

5.3 MEDIUM Published 2020-01-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-01-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-330

Description

The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.

Affected configurations

• linux linux kernel (>= 4.3 <= 5.3.10) • debian debian linux 8.0 • netapp a700s firmware • netapp 8300 firmware • netapp 8700 firmware • netapp a400 firmware • netapp h610s firmware • netapp active iq unified manager • netapp cloud backup • netapp data availability services • netapp e-series santricity os controller (>= 11.0.0 <= 11.70.1) • netapp hci management node • netapp solidfire • netapp steelstore cloud integrated storage

Related

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References