CVE-2008-5162

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-11-26 · updated 2026-06-16
Weakness: CWE-330

Description

The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various network protocols, related to the Yarrow random number generator.

Affected products

FreeBSD: from 6.4 before 7.0; 6.3, 6.3-p1, 6.3-p2, 6.3-p3, 6.3-p4, 6.3-p5 (+23) — fixed in 7.0

How to fix

Upgrade to a fixed version: FreeBSD 7.0. Check the vendor advisory for mitigations.

References

http://osvdb.org/50137
http://secunia.com/advisories/32871
http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.asc
http://securitytracker.com/id?1021276
http://www.securityfocus.com/bid/32447
http://osvdb.org/50137
http://secunia.com/advisories/32871
http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.asc
http://securitytracker.com/id?1021276
http://www.securityfocus.com/bid/32447

Get alerted when CVE-2008-5162 or the next vulnerability affects your stack