CVE-2019-18282

Published: Jan 16, 2020Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.

Affected (14)

Products: Linux: Linux Kernel · Debian: Debian Linux · Netapp: A700s Firmware, 8300 Firmware, 8700 Firmware, A400 Firmware, H610s Firmware, Active Iq Unified Manager, Cloud Backup, Data Availability Services, E Series Santricity Os Controller, Hci Management Node, Solidfire, Steelstore Cloud Integrated Storage

1 product

1 product

12 products

Active Iq Unified Manager

Cloud Backup

Data Availability Services

E Series Santricity Os Controller

Hci Management Node

Solidfire

Steelstore Cloud Integrated Storage

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 4.3 to 5.3.10

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A700s Firmware	All versions

Running on/with	Platform Versions
Netapp A700s	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp 8300 Firmware	All versions

Running on/with	Platform Versions
Netapp 8300	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp 8700 Firmware	All versions

Running on/with	Platform Versions
Netapp 8700	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A400 Firmware	All versions

Running on/with	Platform Versions
Netapp A400	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H610s Firmware	All versions

Running on/with	Platform Versions
Netapp H610s	All versions

Configuration H

7 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Cloud Backup	All versions
Netapp Data Availability Services	All versions
Netapp E Series Santricity Os Controller	From 11.0.0 to 11.70.1
Netapp Hci Management Node	All versions
Netapp Solidfire	All versions
Netapp Steelstore Cloud Integrated Storage	All versions