CVE-2015-5276: Infoleak
It was discovered that the std::randomdevice class in libstdc++ would not properly detect short reads and could return return predictable values if applications used it to obtain randomness from a blocking source such as /dev/random.
Other sources
The std::randomdevice class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5276?
CVE-2015-5276 has been rated as moderate severity due to potential predictability in random number generation.
How do I fix CVE-2015-5276?
To fix CVE-2015-5276, upgrade to a version of the GNU Compiler Collection (GCC) later than 4.9.4.
What systems are affected by CVE-2015-5276?
CVE-2015-5276 affects versions of the GNU Compiler Collection (GCC) up to and including 4.9.4.
What does CVE-2015-5276 affect in libstdc++?
CVE-2015-5276 affects the std::random_device class in libstdc++, allowing predictable values when reading from certain randomness sources.
Is CVE-2015-5276 exploitable?
CVE-2015-5276 can be exploited if applications rely on the std::random_device class for secure random value generation.