PT-2019-2940 · Linux+5 · Linux Kernel+5
Published
2019-03-27
·
Updated
2021-06-14
·
CVE-2019-10638
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 5.1.7
Description
The issue is related to the Linux kernel's handling of IP ID values for connection-less protocols, such as UDP and ICMP. An attacker can track a device by exploiting hash collisions in the kernel's counter array, potentially obtaining the hashing key. This can be achieved by hosting a crafted web page that forces UDP traffic to attacker-controlled IP addresses, utilizing technologies like WebRTC or gQUIC. The vulnerability is also related to errors in processing identifier fields in the Linux kernel's "jhash" hash function, which can allow a remote attacker to disclose protected information using a specially crafted web page.
Recommendations
For Linux kernel versions prior to 5.1.7, update to version 5.1.7 or later to resolve the issue.
As a temporary workaround, consider restricting access to UDP traffic or disabling the use of WebRTC and gQUIC until a patch is applied.
Fix
Inadequate Encryption Strength
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu