tcp: secure_seq: add back ports to TS offset
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.11, 6.6.160, 6.12.94, 6.18.17, 6.19.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: secure_seq: add back ports to TS offset This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") tcp_tw_recycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways. One of them is to bring back TCP ports in TS offset randomization. As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 28ee1b746f493b7c62347d714f58fbf4f70df4f0 · fixed in e873e8c16b2fb743a381a9e59c108e63512301ec; From 28ee1b746f493b7c62347d714f58fbf4f70df4f0 · fixed in 5da5662181ef8a251e3ba564903002c2e87de452; From 28ee1b746f493b7c62347d714f58fbf4f70df4f0 · fixed in eae2f14ab2efccdb7480fae7d42c4b0116ef8805; From 28ee1b746f493b7c62347d714f58fbf4f70df4f0 · fixed in 46e5b0d7cf55821527adea471ffe52a5afbd9caf; From 28ee1b746f493b7c62347d714f58fbf4f70df4f0 · fixed in 165573e41f2f66ef98940cf65f838b2cb575d9d1; From 4.10.14 · fixed in 4.11
- Linux Linux
4.11
- KernelLinux
From 4.11.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.94; From 6.13.0 · fixed in 6.18.17; From 6.19.0 · fixed in 6.19.7