CVE-2024-10026
📋 TL;DR
This vulnerability in Google's gVisor container runtime allows remote attackers to calculate a local IP address and per-boot identifier using weak hashing algorithms and small seed sizes. This could enable device tracking in certain network configurations. Systems using vulnerable versions of gVisor for container isolation are affected.
💻 Affected Systems
- Google gVisor
📦 What is this software?
Gvisor by Google
Gvisor by Google
⚠️ Risk & Real-World Impact
Worst Case
Persistent device tracking across network sessions, potentially enabling correlation of user activities or aiding in targeted attacks.
Likely Case
Limited device fingerprinting capability that could contribute to tracking when combined with other identifiers.
If Mitigated
Minimal impact as the identifiers are local and per-boot, with limited practical tracking value in isolation.
🎯 Exploit Status
Exploitation requires network access to the gVisor instance and understanding of the weak hashing implementation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions containing commits 83f75082e5b03fafca9201d9d9939028f712b0b2, e54bfde79278cafadedbf73c68ee10cb5982f2af, f956b5ac17ae1f60a4d21999b59ba18c55f86d56
Vendor Advisory: https://github.com/google/gvisor/commits
Restart Required: Yes
Instructions:
1. Update gVisor to latest version. 2. Restart all containers using gVisor runtime. 3. Verify the fix by checking gVisor version.
🔧 Temporary Workarounds
Use alternative container runtime
linuxSwitch from gVisor to standard runc or containerd runtime
docker run --runtime=runc ...
containerd config default > /etc/containerd/config.toml
🧯 If You Can't Patch
- Restrict network access to gVisor instances
- Monitor for unusual network patterns targeting gVisor services
🔍 How to Verify
Check if Vulnerable:
Check gVisor version and compare against fixed commits: git log --oneline | grep -E '83f7508|e54bfde|f956b5a'Check Version:
runsc --versionVerify Fix Applied:
Verify the three fix commits are present in your gVisor installation📡 Detection & Monitoring
Log Indicators:
- Unusual network connections to gVisor control ports
- Multiple connection attempts to extract identifiers
Network Indicators:
- Repeated probing of gVisor network services
- Patterns suggesting identifier calculation attempts
SIEM Query:
source="gvisor" AND (dest_port=control_port OR protocol=unusual)🔗 References
- https://github.com/google/gvisor/commit/83f75082e5b03fafca9201d9d9939028f712b0b2
- https://github.com/google/gvisor/commit/e54bfde79278cafadedbf73c68ee10cb5982f2af
- https://github.com/google/gvisor/commit/f956b5ac17ae1f60a4d21999b59ba18c55f86d56
- https://www.ndss-symposium.org/wp-content/uploads/2025-122-paper.pdf
