PT-2019-12481 · Denx+2 · Das U-Boot+2
Eugeniu Rosca
·
Publicado
2019-05-03
·
Atualizado
2020-11-20
·
CVE-2019-11690
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Das U-Boot versions v2014.04 through v2019.04
Description
The issue concerns the generation of random UUID values. In scenarios where CONFIG RANDOM UUID is enabled and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device, attackers can determine UUID values due to the lack of an srand call in the gen rand uuid function.
Recommendations
For Das U-Boot versions v2014.04 through v2019.04, consider implementing a proper random seed initialization to prevent predictable UUID values. As a temporary workaround, consider disabling the use of CONFIG RANDOM UUID until a proper fix is applied.
Correção
Use of Insufficiently Random Values
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Das U-Boot
Suse