Weak Hashing Algorithm in Google gVisor Exposes Device Tracking Risks

CVE-2024-10026

Summary

A vulnerability in Google's gVisor arises from the use of a weak hashing algorithm combined with small sizes of seeds and secrets. This flaw allows remote attackers to potentially calculate a local IP address and generate a per-boot identifier, which can be exploited to track devices under specific conditions. As a result, the integrity and privacy of user sessions may be compromised, highlighting the need for enhanced security measures in gVisor's design.

References