EUVD-2026-42021
GHSA-fghc-hpwq-xm37
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector reflects physical/shell access requirement; no privileges needed; only limited kernel-address confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (Nozomi).
CVSS VectorVendor: Nozomi
Lifecycle Timeline
1DescriptionCVE.org
EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.
AnalysisAI
Predictable KASLR offsets and RNG seeds in Raspberry Pi 5 and Compute Module 5 EEPROM firmware undermine kernel address space layout randomization across all affected devices and reboots. Because the entropy source is deterministic, any attacker who can identify the firmware version can predict kernel memory addresses, reducing KASLR to a known-offset bypass. This does not itself enable code execution, but it significantly lowers the bar for chaining with any memory-corruption vulnerability targeting these devices. No public exploit code has been identified at time of analysis and this is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-331 (Insufficient Entropy) describes failures to generate unpredictable values where security depends on randomness. Here, the EEPROM firmware - the first-stage bootloader stored in SPI flash on Raspberry Pi 5 and Compute Module 5 (CPE: cpe:2.3:a:raspberry_pi:raspberry_pi_5_and_compute_module_5:*:*:*:*:*:*:*:*) - is responsible for seeding the kernel RNG and providing the initial entropy for KASLR before the OS takes over. A defect in this firmware caused it to produce the same or consistently patterned seed values regardless of device instance or reboot, meaning all affected devices share the same effective KASLR slide. KASLR is a probabilistic mitigation that randomizes kernel code and data layout in virtual memory to defeat return-oriented programming (ROP) and similar exploitation techniques; removing its entropy collapses this defense. The secondary effect - delayed boot while the kernel waits for entropy from other sources - indicates the firmware also failed to adequately seed the kernel's entropy pool, potentially affecting cryptographic operations early in the boot sequence.
RemediationAI
The primary fix is an upstream EEPROM firmware update delivered via the rpi-eeprom package; users should apply the patched firmware once a tagged release incorporating PR #841 is available (https://github.com/raspberrypi/rpi-eeprom/pull/841). On Raspberry Pi OS, firmware updates are applied with 'sudo rpi-eeprom-update -a' followed by a reboot. No exact fixed version number has been independently confirmed from the available data - users should verify the changelog of the installed rpi-eeprom package version against the PR merge date. As a compensating control for deployments that cannot immediately update, restricting physical and local shell access to the device reduces the practical exploitability of any secondary vulnerability that would depend on known kernel addresses. There is no network-level workaround since the vulnerability is intrinsic to the firmware and does not expose a remotely reachable attack surface on its own.
Same weakness CWE-331 – Insufficient Entropy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today