The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | centos-upgrade-kernelcentos-upgrade-kernel-rt | Jun 1, 2020 | Jan 16, 2020 |
| Debian | debian-upgrade-linux | Feb 24, 2020 | Jan 16, 2020 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jun 17, 2026 | Mar 8, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-bpftoolhuawei-euleros-2_0_sp8-upgrade-kernelhuawei-euleros-2_0_sp8-upgrade-kernel-develhuawei-euleros-2_0_sp8-upgrade-kernel-headershuawei-euleros-2_0_sp8-upgrade-kernel-sourcehuawei-euleros-2_0_sp8-upgrade-kernel-toolshuawei-euleros-2_0_sp8-upgrade-kernel-tools-libshuawei-euleros-2_0_sp8-upgrade-perfhuawei-euleros-2_0_sp8-upgrade-python-perfhuawei-euleros-2_0_sp8-upgrade-python3-perf | Jul 31, 2020 | Jan 16, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-kerneloracle-linux-upgrade-kernel-uek | Dec 17, 2020 | Oct 22, 2019 |
| Redhat Openshift | linuxrpm-upgrade-redhat-coreos | Dec 29, 2020 | Jan 16, 2020 | |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-kernelredhat-upgrade-kernel-rt | Jun 1, 2020 | Jan 16, 2020 | |
| Ubuntu | ubuntu-upgrade-linuxubuntu-upgrade-linux-awsubuntu-upgrade-linux-aws-5-0ubuntu-upgrade-linux-aws-fipsubuntu-upgrade-linux-aws-hweubuntu-upgrade-linux-azureubuntu-upgrade-linux-azure-5-3ubuntu-upgrade-linux-azure-fipsubuntu-upgrade-linux-fipsubuntu-upgrade-linux-gcpubuntu-upgrade-linux-gcp-5-3ubuntu-upgrade-linux-gke-4-15ubuntu-upgrade-linux-gke-5-0ubuntu-upgrade-linux-hweubuntu-upgrade-linux-hwe-edgeubuntu-upgrade-linux-kvmubuntu-upgrade-linux-lts-xenialubuntu-upgrade-linux-oemubuntu-upgrade-linux-oem-osp1ubuntu-upgrade-linux-oracleubuntu-upgrade-linux-oracle-5-0ubuntu-upgrade-linux-raspi2ubuntu-upgrade-linux-snapdragon | Nov 19, 2024 | Jan 16, 2020 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jan 16, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub