SB2019071802 - Information disclosure in Linux Kernel Connectionless Protocols
Published: July 18, 2019
Security Bulletin ID
SB2019071802
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2019-10638)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the software uses the IP ID values that the kernel produces for connectionless protocols. A remote attacker with a crafted web page can forge the targeted system to send UDP traffic to an attacker-controlled IP address to gain unauthorized access to sensitive information on the system.
Remediation
Install update from vendor's website.
References
- https://arxiv.org/pdf/1906.10478.pdf
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.7
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=355b98553789b646ed97ad801a619ff898471b92
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=df453700e8d81b1bdafdf684365ee2b9431fb702
- https://github.com/torvalds/linux/commit/355b98553789b646ed97ad801a619ff898471b92
- https://github.com/torvalds/linux/commit/55f0fc7a02de8f12757f4937143d8d5091b2e40b
- https://github.com/torvalds/linux/commit/df453700e8d81b1bdafdf684365ee2b9431fb702