CVEvulnerability

CVE-2009-3238

5.5 MEDIUM Published 2009-09-18 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-09-18
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:C/I:N/A:N
Weaknesses
CWE-338

Description

The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."

Affected configurations

• linux linux kernel (< 2.6.30) • canonical ubuntu linux 6.06 • canonical ubuntu linux 8.04 • canonical ubuntu linux 8.10 • canonical ubuntu linux 9.04 • opensuse opensuse 11.0 • suse linux enterprise desktop 10 • suse linux enterprise server 10

Related

Weakness · CWE (1)

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

Referenced by CWE · observed example (2)

  • CWE-330 Use of Insufficiently Random Values weakness
  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References