PT-2025-1599 · Google · Fuchsia

Amit Klein + 3 · Published 2025-01-30 · Updated 2025-07-29 · CVE-2024-10604

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Fuchsia (affected versions not specified)

Description The issue concerns vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields. Specifically, the vulnerabilities affect the TCP Initial Sequence Number (ISN), TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID. These vulnerabilities allow for the values to be guessed under certain circumstances.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2024-10604

Affected Products

Fuchsia

References · 11

• 🔥 https://ndss-symposium.org/wp-content/uploads/2025-122-paper.pdf · Exploit
• https://fuchsia.googlesource.com/fuchsia/+/a3c17a4d6b3140f9175d6cf6ac4eb4e775f8dea8 · Patch
• https://fuchsia.googlesource.com/fuchsia/+/40e7fbcdcd013441daf4492f1ead349a9e5b80dc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-10604 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10604 · Vendor Advisory
• https://twitter.com/CVEnew/status/1885049491969237254 · Twitter Post
• https://t.me/cvenotify/109297 · Telegram Post
• https://t.me/cvenotify/112224 · Telegram Post
• https://twitter.com/CVETracker/status/1885417960057036985 · Twitter Post
• https://t.me/cvedetector/16821 · Telegram Post
• https://t.me/cveNotify/130143 · Telegram Post