CVE-2019-10638
- State
- Published
- Severity
- Not scored
- Published
- Jul 5, 2019
- Updated
- Aug 4, 2024
- Reserved
- Mar 29, 2019
Description
In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 109092vdb-entry
- openSUSE-SU-2019:1716vendor-advisory
- openSUSE-SU-2019:1757vendor-advisory
- DSA-4495vendor-advisory
- 20190812 [SECURITY] [DSA 4495-1] linux security updatemailing-list
- 20190813 [SECURITY] [DSA 4497-1] linux security updatemailing-list
- DSA-4497vendor-advisory
- [debian-lts-announce] 20190814 [SECURITY] [DLA 1884-1] linux security updatemailing-list
- [debian-lts-announce] 20190814 [SECURITY] [DLA 1885-1] linux-4.9 security updatemailing-list
- USN-4117-1vendor-advisory
- USN-4114-1vendor-advisory
- USN-4115-1vendor-advisory
- USN-4116-1vendor-advisory
- USN-4118-1vendor-advisory
- RHSA-2019:3309vendor-advisory
- RHSA-2019:3517vendor-advisory
- 20191108 [slackware-security] Slackware 14.2 kernel (SSA:2019-311-01)mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8
- https://github.com/torvalds/linux/commit/355b98553789b646ed97ad801a619ff898471b92
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=355b98553789b646ed97ad801a619ff898471b92
- https://arxiv.org/pdf/1906.10478.pdf
- https://github.com/torvalds/linux/commit/55f0fc7a02de8f12757f4937143d8d5091b2e40b
- https://github.com/torvalds/linux/commit/df453700e8d81b1bdafdf684365ee2b9431fb702
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=df453700e8d81b1bdafdf684365ee2b9431fb702
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.7
- https://security.netapp.com/advisory/ntap-20190806-0001/
- http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.