6.4
CVE-2014-7284
- EPSS 1.01%
- Veröffentlicht 13.10.2014 10:55:08
- Zuletzt bearbeitet 12.04.2025 10:46:40
- Quelle cve@mitre.org
- Teams Watchlist Login
- Unerledigt Login
The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers to spoof or disrupt IP communication by leveraging the predictability of TCP sequence numbers, TCP and UDP port numbers, and IP ID values.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version3.13.1
Linux ≫ Linux Kernel Version3.13.2
Linux ≫ Linux Kernel Version3.13.3
Linux ≫ Linux Kernel Version3.13.4
Linux ≫ Linux Kernel Version3.13.5
Linux ≫ Linux Kernel Version3.13.6
Linux ≫ Linux Kernel Version3.13.7
Linux ≫ Linux Kernel Version3.13.8
Linux ≫ Linux Kernel Version3.13.9
Linux ≫ Linux Kernel Version3.13.10
Linux ≫ Linux Kernel Version3.13.11
Linux ≫ Linux Kernel Version3.14.1
Linux ≫ Linux Kernel Version3.14.2
Linux ≫ Linux Kernel Version3.14.3
Linux ≫ Linux Kernel Version3.14.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.01% | 0.751 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.4 | 10 | 4.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:P
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.