CVE-2009-3238 | Vulnetix

CVE-2009-3238 PUBLISHED CVSS 5.5 MEDIUM

The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."

EPSS 1.63% · 75.3th percentile

Risk Scores

CVSS 3.1

5.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

1.63%

75.3th percentile

Affected Products

Vendor	Product	Versions
canonical	ubuntu_linux	9.04, 6.06, 8.04
suse	linux_enterprise_desktop	10
linux	linux_kernel	0
opensuse	opensuse	11.0
suse	linux_enterprise_server	10
n/a	n/a	n/a

Timeline

Sep 18, 2009 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 21, 2022 EPSS Score
Jul 13, 2022 EPSS Score
Sep 5, 2022 EPSS Score
Oct 29, 2022 EPSS Score
Dec 21, 2022 EPSS Score
Feb 12, 2023 EPSS Score
Apr 6, 2023 EPSS Score
May 29, 2023 EPSS Score
Jul 21, 2023 EPSS Score

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03836en_us url
USN-852-1 vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=519692 url
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30 url
https://bugzilla.redhat.com/show_bug.cgi?id=499785 url
oval:org.mitre.oval:def:11168 vdb
RHSA-2009:1438 vendor-advisory
SUSE-SA:2009:054 vendor-advisory
37105 third-party-advisory
http://patchwork.kernel.org/patch/21766/ url
37351 third-party-advisory
SUSE-SA:2010:012 vendor-advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8a0a9bd4db63bc45e3017bedeafbd88d0eb84d02 url
https://nvd.nist.gov/vuln/detail/CVE-2009-3238 advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8a0a9bd4db63bc45e3017bedeafbd88d0eb84d02 url
http://patchwork.kernel.org/patch/21766 url

Open in Interactive Console →