CVEvulnerability

CVE-2011-4574

9.8 CRITICAL Published 2021-10-27 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2021-10-27
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-338

Description

PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high resolution timer (the RDTSC instruction). This instruction can be virtualized, and some virtual machine hosts have chosen to disable this instruction, returning 0s or predictable results.

Affected configurations

• polarssl polarssl (< 1.1.0)

Related

Weakness · CWE (1)

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References