524492 – Lack of randomness in Linux kernel network secrets (CVE-2014-7284)

Bug 524492 - Lack of randomness in Linux kernel network secrets (CVE-2014-7284)

Summary: Lack of randomness in Linux kernel network secrets (CVE-2014-7284)

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Kernel (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Kernel Security

URL:	https://web.archive.org/web/201410021...
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2014-10-05 04:33 UTC by kfm
Modified:	2022-03-25 22:24 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description kfm 2014-10-05 04:33:41 UTC

The URL field links to a full analysis of the bug which, for the time being, remains visible via Google webcache. Here is an excerpt:

"... we have identified a problem with Linux kernel, the result of which was that secret random seed values (e.g., net_secret, syncookie_secret, inet_ehash_secret, etc.) were never initialized on some systems. This would mean that values such as IP IDs, TCP sequence numbers, and ephemeral port numbers become far more easily predictable than they should be. Affected systems would be vulnerable to a number of attacks."

Linux 3.13 and 3.14 are reported to be affected. This is the commit that introduced the bug:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a48e429

This is the commit that fixes it:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/include/linux/net.h?id=3d44052

Comment 1 kfm 2014-10-05 04:54:59 UTC

I looked into it further and found that it was fixed in 3.14.5 but not during the lifespan of 3.13. That places gentoo-sources off the hook so I'm not sure if there's anything to do here.

Comment 2 kfm 2019-11-20 01:19:00 UTC

Please make this bug public, then close.

Comment 3 John Helmert III archtester

2022-03-25 22:24:07 UTC

Fixed in 3.15