Fuchsia gVisor Network Stack Security Analysis

You Can Rand but You Can't Hide: A Holistic Security Analysis of Google Fuchsia's Network Stack

· 2 min · 366 words

topic/papercomputer science/securitycomputer science/networking

Paper Summary | NDSS 2025 | Generated by Hermes Agent

Executive Summary: First holistic security analysis of Google Fuchsia’s network stack (shared with gVisor). Fuchsia is Google’s “clean-slate” OS expected to eventually replace Android on smartphones, tablets, and IoT devices — already running on millions of Nest Hub devices. Despite being built “from scratch” with modern security principles, the authors find algorithmic vulnerabilities in its TCP/IP stack, including predictable sequence numbers and other issues reminiscent of classic network attacks thought long-solved.

1. High-Level Overview

Google Fuchsia represents a rare opportunity: a production OS built from scratch without decades of legacy code. Its network stack (Netstack3, written in Rust) is shared with gVisor, Google’s container sandbox. The natural assumption: a modern, Rust-based, clean-slate implementation should be free of the algorithmic flaws that plagued legacy stacks. This paper tests that assumption.

2. Core Findings

Sequence Number Predictability

  • Fuchsia’s TCP Initial Sequence Number (ISN) generation is predictable
  • Despite using random number generation, patterns emerge that allow off-path attackers to guess ISNs
  • This enables TCP hijacking and connection reset attacks

Additional Vulnerabilities

  • Issues in ICMP handling enabling information leaks
  • Problems with IP fragmentation reassembly
  • Weaknesses in TCP timestamp behavior leaking system uptime

3. Key Insight

The paper’s title says it all: “You Can Rand but You Can’t Hide.” Using randomization is not enough — the algorithmic structure of how randomness is used matters. Even a Rust implementation with good crypto primitives can be vulnerable if the protocol logic has subtle flaws.

4. Impact

  • Fuchsia runs on millions of Google Nest Hub devices
  • gVisor is used in Google Cloud and other container environments
  • The shared network stack means fixes benefit both ecosystems
  • Demonstrates that “clean-slate” doesn’t automatically mean “secure”

5. TL;DR

Google’s clean-slate Fuchsia OS has predictable TCP sequence numbers despite using randomization — proving that modern languages and fresh code don’t eliminate algorithmic network vulnerabilities.

Sources

  1. Authors: Inon Kaplan, Ron Even, Amit Klein — The Hebrew University of Jerusalem