CVE-2024-10604: Identifiable Header Values In Fuchsia Leading To Tracking of The User

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-01-30 · updated 2026-06-17
Weakness: CWE-330

Description

Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID allow for these values to be guessed under circumstances

Affected products

Google LLC Fuchsia Kernel: before f16; from f17 before f20 — fixed in f16, f20

How to fix

Upgrade to a fixed version: Google LLC Fuchsia Kernel f16, f20. Check the vendor advisory for mitigations.

References

https://fuchsia.googlesource.com/fuchsia/+/40e7fbcdcd013441daf4492f1ead349a9e5b80dc
https://fuchsia.googlesource.com/fuchsia/+/a3c17a4d6b3140f9175d6cf6ac4eb4e775f8dea8
https://www.ndss-symposium.org/wp-content/uploads/2025-122-paper.pdf

Get alerted when CVE-2024-10604 or the next vulnerability affects your stack