Vulnerability in Linux Kernel
CVE-2009-3238
The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.016 (75.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Linux Kernel
- Canonical Ubuntu Linux — versions 6.06, 8.04, 8.10
- openSUSE — versions 11.0
- SUSE Linux Enterprise Desktop — versions 10
- SUSE Linux Enterprise Server — versions 10
Weakness classification (CWE)
References
- support.hpe.com/hpsc/doc/public/display (Third Party Advisory)
- www.ubuntu.com/usn/USN-852-1 (vendor-advisory, Third Party Advisory)
- patchwork.kernel.org/patch/21766/ (Patch, Broken Link)
- bugzilla.redhat.com/show_bug.cgi (Permissions Required, Issue Tracking)
- www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30 (Exploit, Broken Link, Vendor Advisory)
- secunia.com/advisories/37351 (Broken Link, third-party-advisory)
- bugzilla.redhat.com/show_bug.cgi (Permissions Required, Issue Tracking)
- lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html (vendor-advisory, Mailing List)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11168 (Broken Link, signature, vdb-entry)
- git.kernel.org/ (Broken Link)
Frequently asked questions
- What is CVE-2009-3238?
- CVE-2009-3238 is a medium-severity vulnerability in Linux Kernel, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 5.5/10. Published 2009-09-18.
- How severe is CVE-2009-3238?
- Medium severity. CVSS v3 base score is 5.5 out of 10.