CVE-2024-25389: Weak RNG
RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L seed + 2531011L; return (seed >> 16) & 0x7FFF;" in calcrandom in drivers/misc/rtrandom.c.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25389?
CVE-2024-25389 is classified as a medium severity vulnerability due to its impact on randomness generation.
How do I fix CVE-2024-25389?
To fix CVE-2024-25389, upgrade RT-Thread to version 5.0.3 or later where the random number generation algorithm has been improved.
What are the potential impacts of CVE-2024-25389?
The potential impacts of CVE-2024-25389 include vulnerabilities to cryptographic operations and reduced security in applications relying on randomness.
Is CVE-2024-25389 exploitable remotely?
CVE-2024-25389 is not directly exploitable remotely, but its weak random number generation can lead to security risks in networked applications.
What software versions are affected by CVE-2024-25389?
CVE-2024-25389 affects all RT-Thread versions up to and including 5.0.2.