CVE-2024-10603
Google Gvisor ≤ 20231030.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-10603 is a medium-severity Generation of Predictable Numbers or Identifiers (CWE-340) vulnerability in Google Gvisor. Its CVSS base score is 6.3 (Medium).
Operationally, ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32898
Vulnerability Data
Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover predictable number generation through targeted analysis or fuzzing of identifier creation routines.
Cryptographic key establishment and management mandates proper entropy and randomness during generation, directly stopping predictable identifiers at the source.
Authenticator management requires secure initial distribution and handling of authenticators, structurally preventing predictable values from being usable.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic controls require use of approved, sufficiently random algorithms and key-generation methods, directly mitigating predictable number/identifier weaknesses.
A secure SDLC incorporates threat modelling and secure-design reviews that flag predictable identifier generation early in the lifecycle.
Secure-coding standards explicitly forbid predictable random functions and mandate cryptographically secure RNGs, preventing the weakness at the source.
Security testing in development can detect predictable identifiers through static/dynamic analysis and fuzzing, reducing residual risk.
A.8.5 chooses and strengthens authentication techniques and log-on procedures to substantiate claimed identities; it has no bearing on generation of predictable numbers/identifiers or stopping their exploitation
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.