CVE-2019-10638

MEDIUM

Linux Kernel < 5.1.7 - Weak Encryption

Title source: rule
STIX 2.1

Description

In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses.

References (28)

Core 28
Core References
Mailing List mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Aug/13
Mailing List mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Aug/18
Mailing List mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Nov/11
Third Party Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/109092
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4495
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4497
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html
Mailing List mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4117-1/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4114-1/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4115-1/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4116-1/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4118-1/
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3309
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3517
Mailing List, Release Notes, Vendor Advisory x_refsource_misc
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8
Third Party Advisory x_refsource_misc
https://arxiv.org/pdf/1906.10478.pdf
Mailing List, Release Notes, Vendor Advisory x_refsource_misc
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.7
Vendor Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20190806-0001/

Scores

CVSS v3 6.5
EPSS 0.0076
EPSS Percentile 73.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-326
Status published
Products (1)
linux/linux_kernel < 5.1.7
Published Jul 05, 2019
Tracked Since Feb 18, 2026