NetSight
IP …
medium5.3

CVE-2019-18282

The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f.

Impact

The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.3 through 5.3.10
DebianDebian Linux
Version 8.0
NetappA700s Firmware
All versions
Netapp8300 Firmware
All versions
Netapp8700 Firmware
All versions
NetappA400 Firmware
All versions
NetappH610s Firmware
All versions
NetappActive Iq Unified Manager
All versions
NetappCloud Backup
All versions
NetappData Availability Services
All versions
NetappE-Series Santricity Os Controller
from 11.0.0 through 11.70.1
NetappHci Management Node
All versions

Weakness classification

CWE-330

References