Skip to main content

Gvisor CVE-2024-10026

MEDIUM
Use of Weak Hash (CWE-328)
2025-01-30 cve-coordination@google.com
Google Information Disclosure Gvisor
6.3
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Mar 28, 2026 - 18:06 vuln.today
Patch released
Mar 28, 2026 - 18:06 nvd
Patch available
PoC Detected
Jul 31, 2025 - 18:33 vuln.today
Public exploit code
CVE Published
Jan 30, 2025 - 20:15 nvd
MEDIUM 6.3

DescriptionCVE.org

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

AnalysisAI

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-328. A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances. Affected products include: Google Gvisor.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Gvisor

View all
CVE-2018-19333 CRITICAL POC
9.8 Nov 17

pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in proces
CVE-2025-2713 MEDIUM
6.8 Mar 28

Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file a
CVE-2018-16359 MEDIUM
6.8 Sep 02

Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows at
CVE-2018-20168 MEDIUM
5.5 Dec 17

Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which al
CVE-2024-10603 MEDIUM POC
6.3 Jan 30

Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be

Same weakness CWE-328 – Use of Weak Hash

View all
CVE-2020-37168 CRITICAL POC
9.3
CVE-2023-46133 CRITICAL POC
9.1
CVE-2023-2900 HIGH POC
7.5
CVE-2024-47829 MEDIUM POC
6.5
CVE-2022-3433 MEDIUM POC
6.5
CVE-2025-27595 CRITICAL
9.8
CVE-2026-36182 CRITICAL
9.8
CVE-2024-54143 CRITICAL
9.3

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2023-4966 HIGH POC
7.5

Share

CVE-2024-10026 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy