CVE-2008-5162

Name: CVE-2008-5162
Creator: NVD / NIST
Published: 2008-11-26T23:30:00.467+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7/10EPSS 0.32%

Last modified Jun 16, 2026

CVE-2008-5162 is a high-severity vulnerability rated 7/10 on the CVSS scale. The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various network protocols, related to the Yarrow random number generator.. EPSS estimates a 0.32% chance of exploitation in the next 30 days.

Description

The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict the function's return values and conduct certain attacks against the GEOM framework and various network protocols, related to the Yarrow random number generator.

Metrics

CVSS 3.1

7/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.32%

23.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-330

Affected Software

Vendor	Product	Versions
Freebsd	Freebsd	>= 6.4, < 7.0
Freebsd	Freebsd	6.3
Freebsd	Freebsd	7.0
Freebsd	Freebsd	7.1

References

http://osvdb.org/50137Broken Link
http://secunia.com/advisories/32871Broken Link
http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.ascVendor Advisory
http://securitytracker.com/id?1021276Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/32447Broken Link, Third Party Advisory, VDB Entry
http://osvdb.org/50137Broken Link
http://secunia.com/advisories/32871Broken Link
http://security.freebsd.org/advisories/FreeBSD-SA-08:11.arc4random.ascVendor Advisory
http://securitytracker.com/id?1021276Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/32447Broken Link, Third Party Advisory, VDB Entry

Timeline

Published: Nov 26, 2008
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2008-5162?

How severe is CVE-2008-5162?

CVE-2008-5162 has a CVSS score of 7/10 (HIGH severity). The EPSS model estimates a 0.32% probability of exploitation in the next 30 days.

How do I fix CVE-2008-5162?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2008-5162?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST