The EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produces low‑entropy seeds for both kernel address space layout randomization (KASLR) and system random number generation. This causes kernel addresses to remain consistent across boots and across devices, and reduces the quality of generated random numbers. The predictable KASLR values lower the barrier for attackers that exploit memory corruption or return‑to‑libc attacks, while the weak RNG seed can impair cryptographic operations or lead to boot delays while entropy is gathered from other sources.

The vulnerability is present in the rpi‑eeprom package shipped with Raspberry Pi 5 and Compute Module 5 hardware. No specific minor release is excluded; any installation that has not upgraded to rpi‑eeprom version 28.22‑1 or later exposes the device to the issue.

The CVSS score of 5.1 classifies the issue as moderate severity, and the EPSS score of < 1 % indicates a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker with existing or future vulnerabilities that depend on KASLR or RNG values may gain an easier attack path due to the predictable addresses and seeds. Based on the description, the likely attack vector is inferred to be through applications or kernel modules that rely on the randomness provided by the firmware, and the problem cannot be remedied without a firmware update.