CVE-2024-35875 x86/coco: Require seeding RNG with RDRAND on CoCo systems

In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model means that the VM host cannot be trusted a...

CVE-2024-35875 x86/coco: Require seeding RNG with RDRAND on CoCo systems

In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model means that the VM host cannot be trusted a...

CVE-2024-35875 x86/coco: Require seeding RNG with RDRAND on CoCo systems

In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model means that the VM host cannot be trusted a...

PT-2024-26768

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the Linux kernel's random number generator RNG on CoCo systems. The CoCo threat model means that the VM host cannot be trusted and may actively work against guest...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the fact that the kstackoffset variable actually uses only the low bit of the kernel stack offset entropy...

Weak Entropy In Token Generation

friendsofsymfony/user-bundle is vulnerable to Weak Entropy in Token Generation. The vulnerability is due to the imprecise nature of the baseconvert function used in FOSUserBundle, which allows attackers to exploit the weakened randomness of tokens generated for email confirmation and password...

ShellSweep - PowerShell/Python/Lua Tool Designed To Detect Potential Webshell Files In A Specified Directory

ShellSweep ShellSweeping the evil Why ShellSweep "ShellSweep" is a PowerShell/Python/Lua tool designed to detect potential webshell files in a specified directory. ShellSheep and it's suite of tools calculate the entropy of file contents to estimate the likelihood of a file being a webshell. High...

PT-2024-40045 · Unknown · Random Compat

Name of the Vulnerable Software and Affected Versions: random compat versions prior to 2.0 Description: The issue is related to the insecure usage of Cryptographically Secure Pseudo-Random Number Generators CSPRNG. The affected versions use openssl random pseudo bytes, which may result in...

Insufficient Entropy

laravel/socialite is vulnerable to Insufficient Entropy. The vulnerability is due to an insecure state generation mechanism, potentially exposing the OAuth authentication process to security risks...

FOSUserBundle Entropy is lost in the TokenGenerator

Description Because of the usage of baseconvert which looses precision for large inputs, the entropy of tokens generated by FOSUserBundle for the email confirmation and password resetting is lost. This makes these tokens much less random than they are expected to be, and so not cryptographically...

SUSE-SU-2024:1271-3 Security update for gnutls

This update for gnutls fixes the following issues: - CVE-2024-28834: Fixed side-channel in the deterministic ECDSA bsc1221746 - CVE-2024-28835: Fixed denial of service during certificate chain verification bsc1221747 Other fixes: - jitterentropy: Release the memory of the entropy collector when...

The vulnerability of the autotools CARES_RANDOM_FILE component in the C-ares asynchronous DNS query library allows a attacker to compromise the integrity of the protected information.

The vulnerability of the CARESRANDOMFILE component in the C-ares asynchronous DNS query library is related to the use of rand as a backup mechanism. This allows attackers to exploit the absence of entropy, without using CSPRNG. Exploiting this vulnerability enables remote attackers to compromise...

ROS-20240404-02

Vulnerability of aresinetnetpton function of C-ares asynchronous DNS query library is related to violation of the initial buffer boundary. the initial buffer boundary. Exploitation of the vulnerability could allow an attacker to gain access to confidential data, violate its integrity, and cause a...

The vulnerability of the microprogrammed software of the wireless modems Hitron CODA-4582 and CODA-4589, related to insufficient entropy due to the default use of PSK, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the microprogrammed wireless modems Hitron CODA-4582 and CODA-4589 relates to insufficient entropy due to the use of default PSKs which are generated from 5-digit hexadecimal values combined using the “Hitron” substring. Exploiting this vulnerability could allow an attacker t...

Enhancing Blockchain Randomness To Eliminate Trust Issues Once For All

By Uzair Amir Blockchains lack true randomness, hindering applications like fair games, DeFi, and NFTs. Pyth Networks "Pyth Entropy" solves this… This is a post from HackRead.com Read the original post: Enhancing Blockchain Randomness To Eliminate Trust Issues Once For All...

BIT-NODE-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/cryptokeygen.cc. There are two problems with this: 1 It does not check the return value, it assumes EntropySource always succeeds, but it can a...

CVE-2022-48629 crypto: qcom-rng - ensure buffer for generate is completely filled

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure buffer for generate is completely filled The generate function in struct rngalg expects that the destination buffer is completely filled if the function returns 0. qcomrngread can run into a situation...

CVE-2022-48629 crypto: qcom-rng - ensure buffer for generate is completely filled

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure buffer for generate is completely filled The generate function in struct rngalg expects that the destination buffer is completely filled if the function returns 0. qcomrngread can run into a situation...

CVE-2024-25730

Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insufficient entropy only about one million possibilities...

Design/Logic Flaw

Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insufficient entropy only about one million possibilities...