| Name | CVE-2014-7284 |
| Description | The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers to spoof or disrupt IP communication by leveraging the predictability of TCP sequence numbers, TCP and UDP port numbers, and IP ID values. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| linux (PTS) | jessie, jessie (lts) | 3.16.84-1 | fixed |
| stretch (security) | 4.9.320-2 | fixed | |
| stretch (lts), stretch | 4.9.320-3 | fixed | |
| buster (security), buster, buster (lts) | 4.19.316-1 | fixed | |
| bullseye | 5.10.223-1 | fixed | |
| bullseye (security) | 5.10.226-1 | fixed | |
| bookworm | 6.1.115-1 | fixed | |
| bookworm (security) | 6.1.112-1 | fixed | |
| trixie | 6.11.7-1 | fixed | |
| sid | 6.11.9-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| linux | source | wheezy | (not affected) | |||
| linux | source | (unstable) | 3.16.2-1 | |||
| linux-2.6 | source | (unstable) | (not affected) |
[wheezy] - linux <not-affected> (Vulnerable code introduced in 3.13)
- linux-2.6 <not-affected> (Vulnerable code introduced in 3.13)
Upstream fix: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3d4405226d27b3a215e4d03cfa51f536244e5de7 (v3.15-rc7)
Introduced by https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a48e42920ff38bc90bbf75143fff4555723d4540
http://secondlookforensics.com/ngro-linux-kernel-bug/