CVE-2019-10638
Publication date 5 July 2019
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses.
From the Ubuntu Security Team
Amit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values generated for connectionless networking protocols. A remote attacker could use this to track particular Linux devices.
Status
Package | Ubuntu Release | Status |
---|---|---|
linux | ||
18.04 LTS bionic |
Fixed 4.15.0-60.67
|
|
16.04 LTS xenial |
Fixed 4.4.0-161.189
|
|
14.04 LTS trusty | Ignored | |
linux-aws | ||
18.04 LTS bionic |
Fixed 4.15.0-1047.49
|
|
16.04 LTS xenial |
Fixed 4.4.0-1092.103
|
|
14.04 LTS trusty | Ignored | |
linux-aws-5.0 | ||
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-aws-hwe | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial |
Fixed 4.15.0-1047.49~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-azure | ||
18.04 LTS bionic |
Fixed 5.0.0-1018.19~18.04.1
|
|
16.04 LTS xenial |
Fixed 4.15.0-1056.61
|
|
14.04 LTS trusty | Ignored | |
linux-azure-5.3 | ||
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-azure-edge | ||
18.04 LTS bionic |
Fixed 5.0.0-1018.19~18.04.1
|
|
16.04 LTS xenial |
Fixed 4.15.0-1056.61
|
|
14.04 LTS trusty | Not in release | |
linux-euclid | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-flo | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-gcp | ||
18.04 LTS bionic |
Fixed 4.15.0-1042.45
|
|
16.04 LTS xenial |
Fixed 4.15.0-1041.43
|
|
14.04 LTS trusty | Not in release | |
linux-gcp-5.3 | ||
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-gcp-edge | ||
18.04 LTS bionic |
Fixed 4.15.0-1042.45
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-gke | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-gke-4.15 | ||
18.04 LTS bionic |
Fixed 4.15.0-1041.43
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-gke-5.0 | ||
18.04 LTS bionic |
Fixed 5.0.0-1015.15~18.04.1
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-goldfish | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-grouper | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-hwe | ||
18.04 LTS bionic |
Fixed 5.0.0-27.28~18.04.1
|
|
16.04 LTS xenial |
Fixed 4.15.0-60.67~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-hwe-edge | ||
18.04 LTS bionic | Ignored | |
16.04 LTS xenial |
Fixed 4.15.0-60.67~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-kvm | ||
18.04 LTS bionic |
Fixed 4.15.0-1043.43
|
|
16.04 LTS xenial |
Fixed 4.4.0-1056.63
|
|
14.04 LTS trusty | Not in release | |
linux-lts-trusty | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-lts-utopic | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-lts-vivid | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-lts-wily | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-lts-xenial | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Ignored | |
linux-maguro | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-mako | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-manta | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-oem | ||
18.04 LTS bionic |
Fixed 4.15.0-1056.65
|
|
16.04 LTS xenial | Ignored | |
14.04 LTS trusty | Not in release | |
linux-oem-5.4 | ||
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-oem-osp1 | ||
18.04 LTS bionic |
Fixed 5.0.0-1020.22
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-oracle | ||
18.04 LTS bionic |
Fixed 4.15.0-1022.25
|
|
16.04 LTS xenial |
Fixed 4.15.0-1022.25~16.04.1
|
|
14.04 LTS trusty | Not in release | |
linux-oracle-5.0 | ||
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-raspi2 | ||
18.04 LTS bionic |
Fixed 4.15.0-1044.47
|
|
16.04 LTS xenial |
Fixed 4.4.0-1120.129
|
|
14.04 LTS trusty | Not in release | |
linux-raspi2-5.3 | ||
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release | |
linux-snapdragon | ||
18.04 LTS bionic |
Fixed 4.15.0-1062.69
|
|
16.04 LTS xenial |
Fixed 4.4.0-1124.130
|
|
14.04 LTS trusty | Not in release |
Notes
tyhicks
Kernels prior to 4.1 also need the following commit https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-3.16.y&id=8b197d3ce585d6777197e0633d71e5af7d98cb35
Patch details
Package | Patch details |
---|---|
linux |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.5 · Medium |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-4116-1
- Linux kernel vulnerabilities
- 2 September 2019
- USN-4114-1
- Linux kernel vulnerabilities
- 2 September 2019
- USN-4118-1
- Linux kernel (AWS) vulnerabilities
- 2 September 2019
- USN-4115-1
- Linux kernel vulnerabilities
- 2 September 2019
- USN-4117-1
- Linux kernel (AWS) vulnerabilities
- 2 September 2019