CVE-2022-32296

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-32296
The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://arxiv.org/abs/2209.12993
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9 Release Notes Vendor Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 Mailing List Patch Vendor Advisory
https://github.com/0xkol/rfc6056-device-tracker
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
https://www.debian.org/security/2022/dsa-5173
https://arxiv.org/abs/2209.12993
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9 Release Notes Vendor Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 Mailing List Patch Vendor Advisory
https://github.com/0xkol/rfc6056-device-tracker
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
https://www.debian.org/security/2022/dsa-5173
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:06

Type Values Removed Values Added
References () https://arxiv.org/abs/2209.12993 - () https://arxiv.org/abs/2209.12993 -
References () https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9 - Release Notes, Vendor Advisory () https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9 - Release Notes, Vendor Advisory
References () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 - Mailing List, Patch, Vendor Advisory () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 - Mailing List, Patch, Vendor Advisory
References () https://github.com/0xkol/rfc6056-device-tracker - () https://github.com/0xkol/rfc6056-device-tracker -
References () https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - () https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html -
References () https://www.debian.org/security/2022/dsa-5173 - () https://www.debian.org/security/2022/dsa-5173 -

08 Aug 2023, 14:22

Type Values Removed Values Added
References
  • (MISC) https://arxiv.org/abs/2209.12993 -
  • (MISC) https://github.com/0xkol/rfc6056-device-tracker -
CWE CWE-203 CWE-330
Summary The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056.

04 Jul 2022, 11:15

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2022/dsa-5173 -

01 Jul 2022, 14:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html -

14 Jun 2022, 12:57

Type Values Removed Values Added
CWE CWE-203
CVSS v2 : unknown
v3 : unknown 		v2 : 2.1
v3 : 3.3
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References (MISC) https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9 - (MISC) https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9 - Release Notes, Vendor Advisory
References (MISC) https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 - (MISC) https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 - Mailing List, Patch, Vendor Advisory

05 Jun 2022, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-06-05 22:15

Updated : 2024-11-21 07:06

NVD link : CVE-2022-32296

Mitre link : CVE-2022-32296

CVE.ORG link : CVE-2022-32296

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-330

Use of Insufficiently Random Values