{"id":"CVE-2026-87043","aliases":[],"cve":{"records":[{"id":"CVE-2026-87043","source":"zephyr","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-08T18:40:48.081Z","published":"2026-11-04T06:09:08.600Z","modified":"2026-11-04T06:09:08.600Z"}],"publishers":[{"name":"zephyr","role":"CNA","organizationId":"e2e69745-5e70-4e92-8431-deb5529a81ad","modified":"2026-11-04T06:09:08.600Z"}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/76eb10b5c3e93de5218cc9f1aa313ece3eb5a6e6","tags":["patch"],"source":"zephyr"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j6p3-2pm6-rrj9","tags":[],"source":"zephyr"}],"weaknesses":[{"id":"CWE-330","description":"crypto","source":"zephyr"}],"applicability":[],"prioritization":[]},"title":"sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready","titleSource":"zephyr","descriptionSource":"zephyr","description":"The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from rand_get() as soon as device_is_ready() failed, before reaching the non-cryptographic system-timer fallback further down the same function. Because z_impl_sys_rand_get() returns void and discards that error — and the public sys_rand_get() syscall is itself declared void, so it cannot report failure — the caller's output buffer was left untouched and its previous contents were handed back as random data. The thin wrappers make this a plain uninitialized read: sys_rand32_get() declares uint32_t ret;, calls sys_rand_get(&ret, sizeof(ret)) and returns ret.\n\nThe \"not ready\" state is a normal runtime condition rather than a fault. Entropy drivers initialise at PRE_KERNEL_1 with CONFIG_ENTROPY_INIT_PRIORITY (default 50), so any earlier initialiser — kernel objects run at priority 30 — observes an unready device; the sibling generator subsys/random/random_xoshiro128.c and z_early_rand_get() in kernel/init.c both already carried an explicit timer fallback for exactly this case. The state is also permanent for the boot when an entropy driver's init hook fails, which several in-tree drivers can do on real hardware (entropy_stm32 on an RNG clock configuration error, entropy_psa_crypto when psa_crypto_init() fails, entropy_nrf_cracen, entropy_esp32, entropy_virtio).\n\nWhen this occurs, every non-cryptographic random value in the system is either a constant or stale memory. coap_next_token() in subsys/net/lib/coap/coap.c fills a static buffer, so every CoAP token becomes the same .bss constant; tcp_init_isn() in subsys/net/ip/tcp.c returns an uninitialized stack word as the TCP initial sequence number; DHCPv4/DHCPv6 transaction IDs, WebSocket masking keys and RTP SSRCs are similarly degraded, and arch/arm64/core/pac.c derives per-thread Pointer Authentication keys from the same source. Where the bytes are transmitted directly — SSH packet padding, the netmidi2 session nonce, a DTLS connection ID on builds without CONFIG_CSPRNG_ENABLED — stale caller stack or heap contents are disclosed on the wire.\n\nThe fix initialises ret to -ENODEV and only calls entropy_get_entropy() when the device is ready, so the not-ready case now falls through to the timer fallback and the buffer is always written. The cryptographically secure path is unchanged: sys_csrand_get() still propagates the error to the caller and never silently degrades. An attacker cannot induce the unready state, but can observe and exploit the resulting non-random values remotely on an affected device.","score":4.8,"severity":"medium","published":"2026-11-04T06:09:08.600Z","modified":"2026-11-04T06:09:08.600Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"zephyrproject","name":"zephyr","platforms":[],"versions":[{"version":"4.4.0","status":"affected","lessThan":"4.5.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"zephyr","url":"https://www.cve.org/CVERecord?id=CVE-2026-87043"}],"remediation":[],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/76eb10b5c3e93de5218cc9f1aa313ece3eb5a6e6","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j6p3-2pm6-rrj9"],"sources":[{"name":"CVE","id":"CVE-2026-87043","modified":"2026-11-04T06:09:08.600Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-87043"}],"assessments":[{"source":"zephyr","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8}],"sourceAffected":[],"observedAt":"2026-11-04T06:16:36.109Z","kev":{"status":"not-listed","checkedAt":"2026-11-05T11:10:30.932Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-04T06:20:33.846Z","attemptedAt":"2026-11-04T06:20:33.846Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-04T06:20:33.945Z","attemptedAt":"2026-11-04T06:20:33.945Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-04T06:20:34.399Z","attemptedAt":"2026-11-04T06:20:34.399Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-04T06:20:33.823Z","attemptedAt":"2026-11-04T06:20:33.823Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-87043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87043","modified":"2026-11-04T06:17:07.250","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-11-04T06:20:33.846Z"}],"aiSummary":{"text":"Zephyr versions before 4.5.0 have a vulnerability where sys_rand_get() returns an unwritten buffer when the entropy device is not ready, potentially disclosing stale memory contents. An attacker can observe and exploit the resulting non-random values remotely. The entropy device's 'not ready' state is a normal runtime condition.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T06:21:04.150Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-87043"}]}}