Executive brief
A security issue was identified in the firmware for Raspberry Pi 5 and Compute Module 5 devices that prevents the system from generating truly random security seeds during startup. This flaw causes the device to use predictable memory addresses for the operating system kernel, making it significantly easier for an attacker with local access to bypass built-in security protections. Additionally, the lack of high-quality randomness may cause delays during the boot process or weaken the encryption and security functions of applications running on the device.
Technical details
A vulnerability classified as Insufficient Entropy (CWE-331) exists in the rpi-eeprom package for Raspberry Pi 5 and Compute Module 5. The firmware's bootsys code failed to correctly utilize the Hardware Random Number Generator (HWRNG) when populating the 'rng-seed' and 'kaslr-seed' properties in the Device Tree. Consequently, the Linux kernel uses non-random or consistent values across reboots, effectively neutralizing Kernel Address Space Layout Randomization (KASLR). A local attacker can exploit this predictability to determine the kernel's base address, facilitating the exploitation of other memory-based vulnerabilities. The issue is resolved in rpi-eeprom version 28.22-1.
Affected products
- Raspberry Pi Raspberry Pi 5 and Compute Module 5 EEPROM firmware rpi-eeprom versions prior to 28.22-1
Timeline
- 2026-05-26: patched: Fix merged in rpi-eeprom GitHub repository
- 2026-07-06: advisory: Nozomi Networks Labs published advisory
- 2026-07-07: disclosed: CVE published to NVD