PT-2019-12481 · Denx+2 · Das U-Boot+2

Eugeniu Rosca

·

Published

2019-05-03

·

Updated

2020-11-20

·

CVE-2019-11690

CVSS v3.1

5.9

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Das U-Boot versions v2014.04 through v2019.04
Description The issue concerns the generation of random UUID values. In scenarios where CONFIG RANDOM UUID is enabled and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device, attackers can determine UUID values due to the lack of an srand call in the gen rand uuid function.
Recommendations For Das U-Boot versions v2014.04 through v2019.04, consider implementing a proper random seed initialization to prevent predictable UUID values. As a temporary workaround, consider disabling the use of CONFIG RANDOM UUID until a proper fix is applied.

Fix

Use of Insufficiently Random Values

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-330

Related Identifiers

ALT-PU-2019-2315
ALT-PU-2019-2356
CVE-2019-11690
OPENSUSE-SU-2020:1930-1
OPENSUSE-SU-2020_1930-1
SUSE-SU-2020:3255-1
SUSE-SU-2020:3256-1
SUSE-SU-2020:3282-1
SUSE-SU-2020:3283-1
SUSE-SU-2020:3474-1

Affected Products

Alt Linux
Das U-Boot
Suse