vulnerability
Oracle Linux: CVE-2022-1012: ELSA-2022-5249: kernel security and bug fix update (IMPORTANT) (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 6 | (AV:N/AC:L/Au:N/C:P/I:N/A:P) | 2022-05-02 | 2022-08-09 | 2025-01-07 |
Severity
6
CVSS
(AV:N/AC:L/Au:N/C:P/I:N/A:P)
Published
2022-05-02
Added
2022-08-09
Modified
2025-01-07
Description
A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.
The Linux kernel's TCP source port generation algorithm in the TCP stack contains a flaw due to the small table perturb size. This flaw allows an attacker to positively distinguish a system among devices with identical hardware and software, which lasts until the device restarts.
An attacker can guess the evolution of the internal state used for source port generation. This information is used to infer the TCP traffic patterns of the victim, guessing the number of outgoing TCP connections established in a specific time frame, which can lead to a system fingerprinting.
The Linux kernel's TCP source port generation algorithm in the TCP stack contains a flaw due to the small table perturb size. This flaw allows an attacker to positively distinguish a system among devices with identical hardware and software, which lasts until the device restarts.
An attacker can guess the evolution of the internal state used for source port generation. This information is used to infer the TCP traffic patterns of the victim, guessing the number of outgoing TCP connections established in a specific time frame, which can lead to a system fingerprinting.
Solution
oracle-linux-upgrade-kernel
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.