oss-sec mailing list archives
CVE Request: linux kernel net_get_random_once bug
From: Andrew Tappert <andrew () pikewerks com>
Date: Wed, 01 Oct 2014 14:04:36 -0400
My colleague Tom O'Connor and I have identified a security bug in the Linux kernel that results in drastically degraded randomness of IP IDs, TCP sequence numbers, and ephemeral port numbers on affected systems. The bug existed in kernel versions 3.13 and 3.14. We are posting here rather than to the private "distros" list because the bug has already been fixed. However, we don't think that the security implications of the bug have been acknowledged anywhere, and we think it needs a CVE. A full write-up on the bug is posted at http://secondlookforensics.com/ngro-linux-kernel-bug/. -- Andrew Tappert Raytheon Cyber Products http://secondlookforensics.com/
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- CVE Request: linux kernel net_get_random_once bug Andrew Tappert (Oct 01)
- Re: CVE Request: linux kernel net_get_random_once bug Hannes Frederic Sowa (Oct 01)
- Re: CVE Request: linux kernel net_get_random_once bug cve-assign (Oct 01)