Log in Start free

Vulnerability · Published Jan 30, 2025 · Assigned by Google

CVE-2024-10026Improved Seeding and Hashing In gVisor

Medium 6.3

In plain English

A medium-severity security flaw in gVisor from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.2%top 86.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-gvisor-gvisorno fix listedDEBIAN-CVE-2024-10026
Debian:13golang-gvisor-gvisor0.0~20240729.0-1DEBIAN-CVE-2024-10026
Debian:14golang-gvisor-gvisor0.0~20240729.0-1DEBIAN-CVE-2024-10026
Ubuntu:24.04:LTSgolang-gvisor-gvisorno fix listedUBUNTU-CVE-2024-10026
Ubuntu:25.10golang-gvisor-gvisorno fix listedUBUNTU-CVE-2024-10026
Ubuntu:26.04:LTSgolang-gvisor-gvisorno fix listedUBUNTU-CVE-2024-10026
Ubuntu:26.10golang-gvisor-gvisorno fix listedUBUNTU-CVE-2024-10026
Ubuntu:22.04:LTSgolang-inet-netstackno fix listedUBUNTU-CVE-2024-10026
Ubuntu:24.04:LTSgolang-inet-netstackno fix listedUBUNTU-CVE-2024-10026
Ubuntu:25.10golang-inet-netstackno fix listedUBUNTU-CVE-2024-10026
Ubuntu:26.04:LTSgolang-inet-netstackno fix listedUBUNTU-CVE-2024-10026

Affected products (as reported)

VendorProductVersions
Google gVisor see references

Weakness: CWE-328, CWE-339 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References