Bug 1200288 - (CVE-2022-32296) VUL-0: CVE-2022-32296: kernel-source-rt,kernel-source,kernel-source-azure: insufficient TCP source port randomness leads to client identification
(CVE-2022-32296)
VUL-0: CVE-2022-32296: kernel-source-rt,kernel-source,kernel-source-azure: in...
Status: IN_PROGRESS
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/333685/
CVSSv3.1:SUSE:CVE-2022-32296:5.3:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-06-07 13:55 UTC by Carlos López
Modified: 2022-10-05 19:49 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Carlos López 2022-06-07 14:02:02 UTC
The following branches do not have table_perturb:
 - cve/linux-3.0
 - cve/linux-4.4
 - cve/linux-4.12
 - cve/linux-5.3

The following have table_perturb but with an insufficient INET_TABLE_PERTURB_SHIFT:
 - SLE12-SP5
 - SLE15-SP3
 - SLE15-SP4

stable and master already fixed.

Fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5

Full patchset:
https://lwn.net/Articles/892808/
Comment 6 Thomas Leroy 2022-09-08 10:36:29 UTC
Any news Michal?
Comment 7 Michal Kubeček 2022-09-08 12:47:50 UTC
This looks like a duplicate of CVE-2022-1012 / bsc#1199482

As even the (vague) problem description looks essentially the same, I suggest
not to add any backports beyond what we already did for bsc#1199482.
Comment 8 Thomas Leroy 2022-09-15 09:45:07 UTC
(In reply to Michal Kubeček from comment #7)
> This looks like a duplicate of CVE-2022-1012 / bsc#1199482
> 
> As even the (vague) problem description looks essentially the same, I suggest
> not to add any backports beyond what we already did for bsc#1199482.

Thanks for the the clarification Michal. The underlying issue is indeed the same as CVE-2022-1012 / bsc#1199482. Could it be possible to update the changelog to add this CVE/bsc reference? (CVE-2022-32296/bsc#1200288)?
Comment 9 Michal Kubeček 2022-09-16 13:01:11 UTC
(In reply to Thomas Leroy from comment #8)
>                                 Could it be possible to update the
> changelog to add this CVE/bsc reference? (CVE-2022-32296/bsc#1200288)?

Submitted the references update.

Reassigning to security team.