CVE-2026-87043 sys_rand_get() devuelve silenciosamente un búfer sin escribir cuando el dispositivo de entropía no está listo

Afectados

• zephyrproject zephyr

  desde 4.4.0 hasta antes de 4.5.0

Qué hacer

1. Verificá si usás zephyr y en qué versión.
2. Actualizá a la versión corregida que indique el fabricante en su aviso o aplicá su mitigación.
3. Revisá registros y accesos de los sistemas expuestos para descartar un uso previo.

Calculadora CVSS

CVSS 3.1 · 4.8 MEDIA

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

• Vector de ataqueRed
• Complejidad del ataqueAlta
• Privilegios requeridosNinguno
• Interacción del usuarioNinguna
• AlcanceSin cambio
• ConfidencialidadBaja
• IntegridadBaja
• DisponibilidadNinguna

Descripción original

The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from rand_get() as soon as device_is_ready() failed, before reaching the non-cryptographic system-timer fallback further down the same function. Because z_impl_sys_rand_get() returns void and discards that error — and the public sys_rand_get() syscall is itself declared void, so it cannot report failure — the caller's output buffer was left untouched and its previous contents were handed back as random data. The thin wrappers make this a plain uninitialized read: sys_rand32_get() declares uint32_t ret;, calls sys_rand_get(&ret, sizeof(ret)) and returns ret. The "not ready" state is a normal runtime condition rather than a fault. Entropy drivers initialise at PRE_KERNEL_1 with CONFIG_ENTROPY_INIT_PRIORITY (default 50), so any earlier initialiser — kernel objects run at priority 30 — observes an unready device; the sibling generator subsys/random/random_xoshiro128.c and z_early_rand_get() in kernel/init.c both already carried an explicit timer fallback for exactly this case. The state is also permanent for the boot when an entropy driver's init hook fails, which several in-tree drivers can do on real hardware (entropy_stm32 on an RNG clock configuration error, entropy_psa_crypto when psa_crypto_init() fails, entropy_nrf_cracen, entropy_esp32, entropy_virtio). When this occurs, every non-cryptographic random value in the system is either a constant or stale memory. coap_next_token() in subsys/net/lib/coap/coap.c fills a static buffer, so every CoAP token becomes the same .bss constant; tcp_init_isn() in subsys/net/ip/tcp.c returns an uninitialized stack word as the TCP initial sequence number; DHCPv4/DHCPv6 transaction IDs, WebSocket masking keys and RTP SSRCs are similarly degraded, and arch/arm64/core/pac.c derives per-thread Pointer Authentication keys from the same source. Where the bytes are transmitted directly — SSH packet padding, the netmidi2 session nonce, a DTLS connection ID on builds without CONFIG_CSPRNG_ENABLED — stale caller stack or heap contents are disclosed on the wire. The fix initialises ret to -ENODEV and only calls entropy_get_entropy() when the device is ready, so the not-ready case now falls through to the timer fallback and the buffer is always written. The cryptographically secure path is unchanged: sys_csrand_get() still propagates the error to the caller and never silently degrades. An attacker cannot induce the unready state, but can observe and exploit the resulting non-random values remotely on an affected device.

Referencias (2)

• github.com/zephyrproject-rtos/zephyr/commit/76eb10b5c3e93de5218cc9f1aa313ece3eb5a6e6
• github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j6p3-2pm6-rrj9

Resumen traducido automáticamente de la descripción original. Fuente: Nureq Monitor. Cómo funciona.