CVE-2024-10026
6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Summary
A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| gVisor | Release 20241028.0 | unaffected |
Weaknesses
- CWE-328: CWE-328
- CWE-339: CWE-339
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://github.com/google/gvisor/commit/f956b5ac17ae1f60a4d21999b59ba18c55f86d56
- https://github.com/google/gvisor/commit/e54bfde79278cafadedbf73c68ee10cb5982f2af
- https://github.com/google/gvisor/commit/83f75082e5b03fafca9201d9d9939028f712b0b2
- https://www.ndss-symposium.org/wp-content/uploads/2025-122-paper.pdf
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.