CVE-2024-10026CWE-328CWE-339

Improved Seeding and Hashing In gVisor

Medium · published January 30, 2025

CVSS v4.0
6.3
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00226 · 13.2th percentile
Weaknesses
CWE-328 · Use of Weak Hash; CWE-339 · Small Seed Space in PRNG
Published
2025-01-30T19:12Z
EPSS history
Timeline
  • 30 JAN 19:12Z
    Improved Seeding and Hashing In gVisor
    cvelistv5