CVE-2025-0577: Glibc: vdso getrandom acceleration may return predictable randomness
An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions are called again after the fork, which happens concurrently with a call to any of these functions.
Other sources
In Fedora 40 glibc between glibc-2.39-28.fc40 and glibc-2.39-33.fc40 (inclusive) and in Fedora 41 glibc between glibc-2.40-12.fc41 and glibc-2.40-17.fc41, the vDSO getrandom acceleration (impacting getrandom and the arc4random family of functions) may return predictable randomness if these functions are called again after fork that happened concurrently with a call to any of these functions.
The issue currently impacts CentOS 10 Stream (glibc-2.39-29.el10 to glibc-2.39-33.el10).
No glibc upstream release is impacted, this was caught during glibc 2.41 development.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0577?
The severity of CVE-2025-0577 is classified as medium due to the potential for predictable randomness that could lead to security vulnerabilities.
How do I fix CVE-2025-0577?
To fix CVE-2025-0577, upgrade to the latest version of glibc that addresses the insufficient entropy issue.
What versions of glibc are affected by CVE-2025-0577?
CVE-2025-0577 affects glibc versions from 2.39-28.fc40 to 2.39-33.fc40 and from 2.40-12.fc41 to 2.40-17.fc41, as well as 2.39-29.el10 to 2.39-33.el10.
What vulnerabilities does CVE-2025-0577 introduce?
CVE-2025-0577 introduces the potential for applications relying on getrandom and arc4random functions to generate predictable random values.
Is CVE-2025-0577 a local or remote vulnerability?
CVE-2025-0577 is considered a local vulnerability since it can be exploited through applications running on the same system.