Random Value Prediction Vulnerability in GNU Compiler Collection (GCC)
CVE-2015-5276

Currently unrated

Key Information:

Vendor

Gnu
Status
Gcc
Vendor
CVE Published:
17 November 2015

What is CVE-2015-5276?

The std::random_device class in the GNU Compiler Collection (GCC) prior to version 4.9.4 fails to correctly handle short reads from blocking sources. This oversight allows attackers with context-specific knowledge to predict the random values generated by the library, posing a risk of exploitation through various unspecified vectors. Malicious actors could leverage this weakness to defeat cryptographic protections and compromise system security.

References

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142
x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1262846
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-updates/2015-11/msg000...
vendor-advisoryx_refsource_SUSE

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.