Log in Start free

Vulnerability · Published Jan 30, 2025 · Assigned by Google

CVE-2024-10603

Medium 6.3

In plain English

A medium-severity security flaw in gVisor from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.3%top 80.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-gvisor-gvisorno fix listedDEBIAN-CVE-2024-10603
Debian:13golang-gvisor-gvisor0.0~20240729.0-1DEBIAN-CVE-2024-10603
Debian:14golang-gvisor-gvisor0.0~20240729.0-1DEBIAN-CVE-2024-10603
Ubuntu:24.04:LTSgolang-gvisor-gvisorno fix listedUBUNTU-CVE-2024-10603
Ubuntu:25.10golang-gvisor-gvisorno fix listedUBUNTU-CVE-2024-10603
Ubuntu:26.04:LTSgolang-gvisor-gvisorno fix listedUBUNTU-CVE-2024-10603
Ubuntu:26.10golang-gvisor-gvisorno fix listedUBUNTU-CVE-2024-10603
Ubuntu:22.04:LTSgolang-inet-netstackno fix listedUBUNTU-CVE-2024-10603
Ubuntu:24.04:LTSgolang-inet-netstackno fix listedUBUNTU-CVE-2024-10603
Ubuntu:25.10golang-inet-netstackno fix listedUBUNTU-CVE-2024-10603
Ubuntu:26.04:LTSgolang-inet-netstackno fix listedUBUNTU-CVE-2024-10603

Affected products (as reported)

VendorProductVersions
Google gVisor see references

Weakness: CWE-340 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References