Read the docs
TI-2024-09826 Aliases CVE-2024-10604GHSA-mhfq-8c27-vp58

Identifiable Header Values In Fuchsia Leading To Tracking of The User

Priority LOW 36CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID allow for these values to be guessed under circumstances

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00237 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Fuchsia (Google): Release F19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleFuchsia—Release F19Patch availableCNA
  • Fuchsia VendorGoogle Affected — Fixed in Release F19 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:google:fuchsia:*:*:*:*:*:*:*:*before f16; f17 to before f20VulnerableGoogle
  • cpe:2.3:o:google:fuchsia:*:*:*:*:*:*:*:* Versions before f16; f17 to before f20 Vulnerable ·Google

Remediation

  • Fix · CNA Fuchsia (Google) Fixed in Release F19

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10604
  2. 2026-10-03 Alias added: GHSA-mhfq-8c27-vp58

References

Exploit 1

Patch 2

  • TI-2022-00787 Illegal access to Kernel log in Fuchsia CVSS 3.1MEDIUM 5.5
  • TI-2022-00182 Write access to VMO data through copy-on-write in Fuchsia CVSS 3.1HIGH 7.5
  • TI-2021-05515 Integer Overflow in Fuchsia Kernel CVSS 3.1HIGH 7.8
  • TI-2021-05520 Incorrect mapping of Executable bits in Fuchsia Kernel CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences