gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIG_RANDOM_UUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade u-boot | Jul 30, 2024 | May 3, 2019 |
| Huawei Euleros 2_0_sp9 | — | Upgrade uboot-toolsUpgrade uboot-tools-help | Mar 3, 2022 | May 3, 2019 |
| Suse | — | Upgrade u-boot-rpi3Upgrade u-boot-tools | Nov 10, 2020 | May 3, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 3, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub