What’s Vulnerable › Vulnerabilities
CVE-2009-3238
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2009-09-18 · updated 2026-06-16
- Weakness: CWE-338
Description
The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
Affected products
- Canonical Ubuntu Linux: 6.06, 8.04, 8.10, 9.04
- Linux kernel: before 2.6.30 — fixed in 2.6.30
- Opensuse: 11.0
- SUSE Linux Enterprise Server 15 SP1: 10-sp2
- SUSE Linux Enterprise Server: 10-sp2
How to fix
Upgrade to a fixed version: Linux kernel 2.6.30. Check the vendor advisory for mitigations.
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8a0a9bd4db63bc45e3017bedeafbd88d0eb84d02
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html
- http://patchwork.kernel.org/patch/21766/
- http://secunia.com/advisories/37105
- http://secunia.com/advisories/37351
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30
- http://www.redhat.com/support/errata/RHSA-2009-1438.html
- http://www.ubuntu.com/usn/USN-852-1
- https://bugzilla.redhat.com/show_bug.cgi?id=499785
- https://bugzilla.redhat.com/show_bug.cgi?id=519692
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11168
Get alerted when CVE-2009-3238 or the next vulnerability affects your stack