CVE-2011-4574

PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high resolution timer (the RDTSC instruction). This instruction can be virtualized, and some virtual machine hosts have chosen to disable this instruction, returning 0s or predictable results.
Configurations

Configuration 1 (hide)

cpe:2.3:a:polarssl:polarssl:*:*:*:*:*:*:*:*

History

21 Nov 2024, 01:32

Type Values Removed Values Added
References () https://tls.mbed.org/tech-updates/security-advisories/polarssl-security-advisory-2011-02 - Third Party Advisory () https://tls.mbed.org/tech-updates/security-advisories/polarssl-security-advisory-2011-02 - Third Party Advisory

Information

Published : 2021-10-27 01:15

Updated : 2024-11-21 01:32


NVD link : CVE-2011-4574

Mitre link : CVE-2011-4574

CVE.ORG link : CVE-2011-4574


JSON object : View

Products Affected

polarssl

  • polarssl
CWE
CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)