Vulnerability in Linux Kernel
CVE-2009-3238
The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
EPSS: 0.016 (73.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Linux Linux_kernel
- Canonical Ubuntu_linux — versions 6.06, 8.04, 8.10
- Opensuse — versions 11.0
- Suse Linux_enterprise_desktop — versions 10
- Suse Linux_enterprise_server — versions 10
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Broken Link)
- cve@mitre.org (Permissions Required, x_refsource_CONFIRM, Issue Tracking)
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Broken Link, Vendor Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (Permissions Required, x_refsource_CONFIRM, Issue Tracking)
- cve@mitre.org (vendor-advisory, Mailing List, x_refsource_SUSE)
- cve@mitre.org (Broken Link, signature, x_refsource_OVAL, vdb-entry)
- cve@mitre.org (x_refsource_CONFIRM, Broken Link)
Frequently asked questions
- What is CVE-2009-3238?
- CVE-2009-3238 is a medium-severity vulnerability in Linux Kernel, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 5.5/10. Published 2009-09-18.
- How severe is CVE-2009-3238?
- Medium severity. CVSS v3 base score is 5.5 out of 10.