CVE-2024-10026: google gvisor Use of Weak Hash
CVSS: 6.3v4.0MediumAnalyzed
AliasesUBUNTU-CVE-2024-10026DEBIAN-CVE-2024-10026
Published 30-01-2025Last modified 24-02-2025
Vulnerability summary
CVE-2024-10026 is a medium (CVSS 6.3) Use of Weak Hash vulnerability in google gvisor. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.3/10
010
Medium · v4.0 (CVE.org)EPSS score
0.22%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 30-01-2025PublishedVulnerability first disclosed.
- 24-02-2025Last modifiedVulnerability information updated.
Description
A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.
CVSS metrics
6 scores · 4 sources · 2 versionsMedium 6.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 5.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
0.00 pp
From 0.23% on 18-09-2026
18-09-202618-10-2026
EPSS score0.22%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (ndss-symposium.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-328Use of Weak HashThe product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
- CWE-339Small Seed Space in PRNGA Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks.
- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
- CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
Affected systems
Ubuntu2 products
- golang-gvisor-gvisorAll versions (No fix recorded)
- golang-inet-netstackAll versions (No fix recorded)
Debian1 product
- golang-gvisor-gvisorAll versions (No fix recorded) | < 0.0~20240729.0-1
Google1 product
- gvisor< 20231030.0 | ≥ 20231106.0, < 20231204.0
3 vendors · 4 products
References
8 links- www.ndss-symposium.org/wp-content/uploads/2025-122-paper.pdfExploitTechnical DescriptionThird Party Advisory
