Vulnetix
Try Vulnetix Request Demo
CVE-2019-10638 PUBLISHED

In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses.

EPSS 0.76% · 73.2th percentile

Risk Scores

EPSS Score
0.76%
73.2th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSlinux-oem-osp10, 5.0.0-1012.13, 5.0.0-1015.16
Ubuntu:22.04:LTSlinux-intel-iot-realtime5.15.0-1073.75, 0
Ubuntu:20.04:LTSlinux-riscv5.4.0-40.45, 5.4.0-39.44, 5.4.0-37.42
Ubuntu:Pro:FIPS:16.04:LTSlinux-fips0, 0, 4.4.0-1003.3
Ubuntu:Pro:FIPS:18.04:LTSlinux-gcp-fips0, 4.15.0-1001.1
Ubuntu:18.04:LTSlinux-snapdragon4.15.0-1053.57, 4.4.0-1081.86, 4.4.0-1079.84
Ubuntu:22.04:LTSlinux-realtime0, 5.15.0-1032.35
Ubuntu:18.04:LTSlinux-gke-5.05.0.0-1013.13~18.04.1, 5.0.0-1011.11~18.04.1, 0
Ubuntu:16.04:LTSlinux-kvm4.4.0-1004.9, 4.4.0-1054.61, 4.4.0-1052.59
Ubuntu:22.04:LTSlinux-riscv5.15.0-1011.12, 5.15.0-1028.32, 5.15.0-1027.31
Ubuntu:18.04:LTSlinux-gke-4.154.15.0-1040.42, 4.15.0-1037.39, 4.15.0-1036.38
Ubuntu:Pro:14.04:LTSlinux3.13.0-194.245, 3.13.0-129.178, 3.13.0-132.181
Ubuntu:18.04:LTSlinux-gcp4.15.0-1019.20, 4.15.0-1018.19, 4.15.0-1017.18
Ubuntu:18.04:LTSlinux-hwe4.18.0-16.17~18.04.1, 5.0.0-25.26~18.04.1, 5.0.0-23.24~18.04.1
Ubuntu:18.04:LTSlinux-oem4.15.0-1036.41, 0, 4.15.0-1002.3
Ubuntu:16.04:LTSlinux-aws-hwe4.15.0-1039.41~16.04.1, 0, 4.15.0-1030.31~16.04.1
Ubuntu:Pro:20.04:LTSlinux-azure-fde-5.155.15.0-1076.85~20.04.1.1, 5.15.0-1019.24~20.04.1.1, 5.15.0-1020.25~20.04.1.1
Ubuntu:16.04:LTSlinux-azure4.15.0-1030.31~16.04.1, 4.13.0-1016.19, 4.13.0-1018.21
Ubuntu:18.04:LTSlinux-oracle4.15.0-1021.23, 4.15.0-1018.20, 4.15.0-1017.19
Ubuntu:Pro:14.04:LTSlinux-azure4.15.0-1041.45~14.04.1, 4.15.0-1036.38~14.04.2, 4.15.0-1037.39~14.04.2

…and 22 more

Timeline

References

Open in Interactive Console →