Every CVE Search/ Get API key

CVE-2024-10026

Improved Seeding and Hashing In gVisor

6.3 MediumFix available

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.23%Up 0.2 points since Jan 31, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.3

Improved Seeding and Hashing In gVisor

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Record
CVE-2024-10026
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-328, CWE-339
Updated
2026-11-02
EUVDEUVD-2024-33023 6.3

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Record
EUVD-2024-33023
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-w2xg-49x3-6w59 6.3

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote...

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Record
GHSA-w2xg-49x3-6w59
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-326, CWE-328
Updated
2026-11-02
NVD 6.3

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Record
CVE-2024-10026
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-328, CWE-339, CWE-326, CWE-335
Updated
2026-11-02
OSV 6.3

Improved Seeding and Hashing In gVisor

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Record
CVE-2024-10026
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-328, CWE-339
Updated
2026-11-02
OSVDEBIAN-CVE-2024-10026 5.3

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Record
DEBIAN-CVE-2024-10026
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-10026 6.3

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Record
UBUNTU-CVE-2024-10026
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVAZL-56192 No score

CVE-2024-10026 affecting package podman 4.1.1-26

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Record
AZL-56192
Updated
2026-11-02
OSVAZL-56201 No score

CVE-2024-10026 affecting package podman for versions less than 5.6.1-2

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Record
AZL-56201
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
podman
Azure Linux:2
 through 4.1.1-26 None known
podman
Azure Linux:3
 before 5.6.1-2
5.6.1-2
golang-gvisor-gvisor
Debian:12
 All versions, plus listed versions
0.0~20221219.0-20.0~20230807.0-10.0~20230807.0-20.0~20230807.0-30.0~20230807.0-4
Show 12 moreShow less
0.0~20230807.0-4~bpo12+10.0~20230807.0-50.0~20240729.0-10.0~20240729.0-20.0~20240729.0-30.0~20240729.0-40.0~20240729.0-4~bpo12+10.0~20240729.0-4~bpo12+20.0~20240729.0-50.0~20240729.0-60.0~20240729.0-70.0~20261026.0-1
 None known
golang-gvisor-gvisor
Debian:13
 before 0.0~20240729.0-1
0.0~20240729.0-1
golang-gvisor-gvisor
Debian:14
 before 0.0~20240729.0-1
0.0~20240729.0-1
golang-inet-netstack
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.0~git20211120.8aa80cf2-10.0~git20211120.8aa80cf2-20.0~git20211120.8aa80cf2-5
 None known
golang-gvisor-gvisor
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.0~20230807.0-4build10.0~20230807.0-4ubuntu0.24.04.10.0~20230807.0-4ubuntu0.24.04.20.0~20230807.0-4ubuntu0.24.04.3
 None known
golang-inet-netstack
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.0~git20211120.8aa80cf2-6
 None known
golang-gvisor-gvisor
Ubuntu:25.10
 All versions, plus listed versions
0.0~20240729.0-4
 None known
golang-inet-netstack
Ubuntu:25.10
 All versions, plus listed versions
0.0~git20211120.8aa80cf2-6
 None known
golang-gvisor-gvisor
Ubuntu:26.10
 All versions, plus listed versions
0.0~20240729.0-7
 None known
golang-gvisor-gvisor
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.0~20240729.0-40.0~20240729.0-50.0~20240729.0-7
 None known
golang-inet-netstack
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.0~git20211120.8aa80cf2-6
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-10026 is a medium vulnerability (CVSS 6.3) in Google Gvisor, published January 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in podman 5.6.1-2.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open