Vulnerability Details CVE-2019-11690
gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CONFIG_RANDOM_UUID is enabled, and Das U-Boot is relied upon for UUID values of a GUID Partition Table of a boot device.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 54.3%
CVSS Severity
CVSS v3 Score 5.9
CVSS v2 Score 4.3
Products affected by CVE-2019-11690
-
cpe:2.3:a:denx:u-boot:2014.04
-
cpe:2.3:a:denx:u-boot:2014.07
-
cpe:2.3:a:denx:u-boot:2014.10
-
cpe:2.3:a:denx:u-boot:2015.01
-
cpe:2.3:a:denx:u-boot:2015.04
-
cpe:2.3:a:denx:u-boot:2015.07
-
cpe:2.3:a:denx:u-boot:2015.10
-
cpe:2.3:a:denx:u-boot:2016.01
-
cpe:2.3:a:denx:u-boot:2016.03
-
cpe:2.3:a:denx:u-boot:2016.05
-
cpe:2.3:a:denx:u-boot:2016.07
-
cpe:2.3:a:denx:u-boot:2016.09
-
cpe:2.3:a:denx:u-boot:2016.09.01
-
cpe:2.3:a:denx:u-boot:2016.11
-
cpe:2.3:a:denx:u-boot:2017.01
-
cpe:2.3:a:denx:u-boot:2017.03
-
cpe:2.3:a:denx:u-boot:2017.05
-
cpe:2.3:a:denx:u-boot:2017.07
-
cpe:2.3:a:denx:u-boot:2017.09
-
cpe:2.3:a:denx:u-boot:2017.11
-
cpe:2.3:a:denx:u-boot:2018.01
-
cpe:2.3:a:denx:u-boot:2018.03
-
cpe:2.3:a:denx:u-boot:2018.05
-
cpe:2.3:a:denx:u-boot:2018.07
-
cpe:2.3:a:denx:u-boot:2018.09
-
cpe:2.3:a:denx:u-boot:2018.11
-
cpe:2.3:a:denx:u-boot:2019.01
-
cpe:2.3:a:denx:u-boot:2019.04