CVE-2024-10026 Improved Seeding and Hashing In gVisor

Medium 6.3 Published 30 Jan 2025 Updated 24 Feb 2025

Weak hashing in gVisor allows remote attackers to calculate local IP addresses and boot identifiers, potentially aiding in device tracking.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-10026?

CVE-2024-10026 is a medium-severity vulnerability in Google gVisor, published on 30 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Weakness: CWE-335, CWE-326, CWE-339, CWE-328

Which versions are affected by CVE-2024-10026?

It affects 1 product.

Products include Google Gvisor.

How do I fix CVE-2024-10026?

Apply the vendor's patch.

Is CVE-2024-10026 being exploited?

There is no known exploitation of CVE-2024-10026 in the wild and no public exploit code.

Sources

Also known as AZL-56192, AZL-56201, DEBIAN-CVE-2024-10026, GHSA-w2xg-49x3-6w59, UBUNTU-CVE-2024-10026.