GNU glibc up to 2.40 arc4random random values

Summaryinfo

A vulnerability was found in GNU glibc up to 2.40. It has been rated as problematic. The impacted element is the function arc4random. The manipulation leads to random values. This vulnerability is uniquely identified as CVE-2025-0577. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in GNU glibc up to 2.40. It has been rated as problematic. This issue affects the function arc4random. The manipulation with an unknown input leads to a random values vulnerability. Using CWE to declare the problem leads to CWE-330. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. Impacted is confidentiality.

It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2025-0577 since 01/19/2025. The exploitation is known to be difficult. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 214654 (Fedora 41 : glibc (2025-497995b101)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.41 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (214654). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• GNU

Name

• glibc

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39
• 2.40

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion