CVE-2019-11690: Medium severity das u-boot vulnerability
genranduuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIGRANDOMUUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-11690?
CVE-2019-11690 is a vulnerability in Das U-Boot versions 2014.04 through 2019.04 that allows attackers to determine UUID values in certain scenarios.
How does CVE-2019-11690 affect Das U-Boot?
CVE-2019-11690 affects Das U-Boot versions 2014.04 through 2019.04 by lacking an srand call, which allows UUID values to be determined when CONFIG_RANDOM_UUID is enabled.
What is the severity of CVE-2019-11690?
The severity of CVE-2019-11690 is medium with a CVSSv3 base score of 5.9.
How can I fix CVE-2019-11690?
To fix CVE-2019-11690, update the affected Das U-Boot version to 2019.07 or later where the srand call has been added to gen_rand_uuid function.
Where can I find more information about CVE-2019-11690?
More information about CVE-2019-11690 can be found at the following reference: https://patchwork.ozlabs.org/patch/1092945