Description
The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers to spoof or disrupt IP communication by leveraging the predictability of TCP sequence numbers, TCP and UDP port numbers, and IP ID values.
References (6)
Core 6
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1148788
Vendor Advisory x_refsource_confirm
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.5
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/10/01/19
Exploit x_refsource_misc
https://web.archive.org/web/20141002163852/http://secondlookforensics.com/ngro-linux-kernel-bug/
Patch x_refsource_confirm
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3d4405226d27b3a215e4d03cfa51f536244e5de7
Exploit x_refsource_confirm
https://github.com/torvalds/linux/commit/3d4405226d27b3a215e4d03cfa51f536244e5de7
Scores
EPSS
0.0375
EPSS Percentile
88.6%
Details
CWE
CWE-200
Status
published
Products (15)
linux/linux_kernel
3.13.1
linux/linux_kernel
3.13.2
linux/linux_kernel
3.13.3
linux/linux_kernel
3.13.4
linux/linux_kernel
3.13.5
linux/linux_kernel
3.13.6
linux/linux_kernel
3.13.7
linux/linux_kernel
3.13.8
linux/linux_kernel
3.13.9
linux/linux_kernel
3.13.10
... and 5 more
Published
Oct 13, 2014
Tracked Since
Feb 18, 2026