CVE-2019-18282

The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value remains the same starting from boot time, and can be inferred by an attacker. This affects net/core/flow_dissector.c and related code.

• CWE-330

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.10Mailing List, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=55667441c84fa5e0911a0aac44fb059c15ba6da2Mailing List, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200204-0002/Third Party Advisory
• https://www.computer.org/csdl/proceedings-article/sp/2020/349700b594/1j2LgrHDR2oThird Party Advisory
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.10Mailing List, Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=55667441c84fa5e0911a0aac44fb059c15ba6da2Mailing List, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200204-0002/Third Party Advisory
• https://www.computer.org/csdl/proceedings-article/sp/2020/349700b594/1j2LgrHDR2oThird Party Advisory

Published

Jan 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18277A flaw was found in HAProxy before 2.0.6. In legacy mode, me…7.5
• CVE-2019-18278When executing VideoLAN VLC media player 3.0.8 with libqt on…7.8
• CVE-2019-18279In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the inclu…8.8
• CVE-2019-1828A vulnerability in the web-based management interface of Cis…5.9
• CVE-2019-18280Sourcecodester Online Grading System 1.0 is affected by a Cr…8.8
• CVE-2019-18281An out-of-bounds memory access in the generateDirectionalRun…4.3
• CVE-2019-18283A vulnerability has been identified in SPPA-T3000 Applicatio…9.8
• CVE-2019-18284A vulnerability has been identified in SPPA-T3000 Applicatio…9.8
• CVE-2019-18285A vulnerability has been identified in SPPA-T3000 Applicatio…5.9
• CVE-2019-18286A vulnerability has been identified in SPPA-T3000 Applicatio…5.3
• CVE-2019-18287A vulnerability has been identified in SPPA-T3000 Applicatio…5.3
• CVE-2019-18288A vulnerability has been identified in SPPA-T3000 Applicatio…8.8