VULNERABILITY INTELLIGENCE
CVE-2009-3238
CVSS score5.5 MEDIUM
EPSS probability1.63%
CISA KEVNot currently listed
Published2009-09-18
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Description
The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
Weakness classification
- CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Primary references
- cve@mitre.org — Broken Link
- cve@mitre.org — Mailing List
- cve@mitre.org — Mailing List
- cve@mitre.org — Broken Link, Patch
- cve@mitre.org — Broken Link
- cve@mitre.org — Broken Link
- cve@mitre.org — Broken Link, Exploit, Vendor Advisory
- cve@mitre.org — Broken Link
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Issue Tracking, Permissions Required
- cve@mitre.org — Issue Tracking, Permissions Required
- cve@mitre.org — Broken Link