Bug 1796360 (CVE-2019-18282) - CVE-2019-18282 kernel: The flow_dissector feature allows device tracking
Summary: CVE-2019-18282 kernel: The flow_dissector feature allows device tracking
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-18282
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1789862 1796364 1796365 1835614 1835615 1835616 1835617 1835618
Blocks: 1805744
TreeView+ depends on / blocked
 
Reported: 2020-01-30 09:36 UTC by msiddiqu
Modified: 2021-02-16 20:42 UTC (History)
46 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A device tracking vulnerability was found in the flow_dissector feature in the Linux kernel. This flaw occurs because the auto flowlabel of the UDP IPv6 packet relies on a 32-bit hashmd value as a secret, and jhash (instead of siphash) is used. The hashmd value remains the same starting from boot time and can be inferred by an attacker.
Clone Of:
Environment:
Last Closed: 2020-12-15 22:18:17 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:0138 0 None None None 2021-01-14 11:41:23 UTC
Red Hat Product Errata RHSA-2020:5437 0 None None None 2020-12-15 11:11:55 UTC
Red Hat Product Errata RHSA-2020:5441 0 None None None 2020-12-15 11:16:45 UTC

Description msiddiqu 2020-01-30 09:36:06 UTC 
The flow_dissector feature in the Linux kernel has a device tracking vulnerability. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashmd value as a secret, and because jhash (instead of siphash) is used. The hashmd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.

Upstream commit:

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=55667441c84fa5e0911a0aac44fb059c15ba6da2

References: 

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.10
Comment 1 msiddiqu 2020-01-30 09:39:53 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1796364]
Comment 2 Justin M. Forbes 2020-01-30 15:55:05 UTC 
This was fixed for Fedora with the 5.3.10 stable kernel update.
Comment 11 Wade Mealing 2020-05-14 07:30:07 UTC 
Identification of systems behind network routers in itself is not a security vulnerability, allowing identification of them when not intended could be considered one.

There is no trust boundary crossed in this flaw.  It is an 'information leak' about systems behind the system being used as a router.  By itself, it provides no real threat to a the system acting as a router.
Comment 19 Petr Matousek 2020-05-26 12:54:54 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 21 Wade Mealing 2020-05-27 05:47:07 UTC 
Also, updated my config files, background updating tool wasnt working.
Comment 22 errata-xmlrpc 2020-12-15 11:11:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:5437 https://access.redhat.com/errata/RHSA-2020:5437
Comment 23 errata-xmlrpc 2020-12-15 11:16:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:5441 https://access.redhat.com/errata/RHSA-2020:5441
Comment 24 Product Security DevOps Team 2020-12-15 22:18:17 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-18282
Note You need to log in before you can comment on or make changes to this bug.