Description
The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.
References (5)
Core 5
Core References
Mailing List, Vendor Advisory x_refsource_misc
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.10
Mailing List, Patch, Vendor Advisory x_refsource_confirm
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=55667441c84fa5e0911a0aac44fb059c15ba6da2
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20200204-0002/
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html
Third Party Advisory x_refsource_misc
https://www.computer.org/csdl/proceedings-article/sp/2020/349700b594/1j2LgrHDR2o
Scores
CVSS v3
5.3
EPSS
0.0261
EPSS Percentile
83.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-330
Status
published
Products (14)
debian/debian_linux
8.0
linux/linux_kernel
4.3 - 5.3.10
netapp/8300_firmware
netapp/8700_firmware
netapp/a400_firmware
netapp/a700s_firmware
netapp/active_iq_unified_manager
netapp/cloud_backup
netapp/data_availability_services
netapp/e-series_santricity_os_controller
11.0.0 - 11.70.1
... and 4 more
Published
Jan 16, 2020
Tracked Since
Feb 18, 2026