CVE-2022-48629

CVE-2022-48629 addresses a vulnerability in the Linux kernel's qcom-rng crypto driver, specifically affecting the generation of random numbers. The issue arises because the qcom_rng_read() function could return partially filled buffers, leading to sections of zeros in the generated randomness, thereby compromising its quality. This flaw impacts products utilizing the Linux kernel, such as the msm8974 SoC found in devices like the Nexus 5. The vulnerability is rated Medium severity (CVSS 5.5) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. This indicates that a local attacker with low privileges can exploit it with low attack complexity, potentially leading to a high impact on availability by degrading the quality of cryptographic randomness. There is no direct impact on confidentiality or integrity. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness or concern regarding its exploitation.