CVE-2009-3228

Name: CVE-2009-3228
Creator: NVD / NIST
Published: 2009-10-19T20:00:00.61+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.40%

Last modified Jun 16, 2026

CVE-2009-3228 is a vulnerability of currently unknown severity. The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.. EPSS estimates a 0.40% chance of exploitation in the next 30 days.

Description

The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.

Metrics

EPSS Probability

0.40%

31.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-909

Affected Software

Vendor	Product	Versions
Linux	Linux Kernel	>= 2.4.0, < 2.4.37.6
Linux	Linux Kernel	>= 2.6.0, < 2.6.31
Linux	Linux Kernel	2.6.31
Canonical	Ubuntu Linux	6.06
Canonical	Ubuntu Linux	8.04
Canonical	Ubuntu Linux	8.10
Canonical	Ubuntu Linux	9.04
Canonical	Ubuntu Linux	9.10
Redhat	Enterprise Linux Desktop	5.0
Redhat	Enterprise Linux Eus	5.4
Redhat	Enterprise Linux Server	5.0
Redhat	Enterprise Linux Workstation	5.0

References

http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=096ed17f20affc2db0e307658c69b67433992a7a
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=16ebb5e0b36ceadc8186f71d68b0c4fa4b6e781b
http://lists.vmware.com/pipermail/security-announce/2010/000082.htmlThird Party Advisory
http://patchwork.ozlabs.org/patch/32830/Patch, Third Party Advisory
http://secunia.com/advisories/37084Third Party Advisory
http://secunia.com/advisories/38794Third Party Advisory
http://secunia.com/advisories/38834Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.6Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.31/ChangeLog-2.6.31-rc9Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2010:198Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/03/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/05/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/06/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/07/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/17/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/17/9Mailing List, Patch, Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1522.htmlThird Party Advisory
http://www.securitytracker.com/id?1023073Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/usn-864-1Third Party Advisory
http://www.vupen.com/english/advisories/2010/0528Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=520990Issue Tracking, Patch, Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6757Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9409Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2009-1540.htmlThird Party Advisory
https://rhn.redhat.com/errata/RHSA-2009-1548.htmlThird Party Advisory
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=096ed17f20affc2db0e307658c69b67433992a7a
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=16ebb5e0b36ceadc8186f71d68b0c4fa4b6e781b
http://lists.vmware.com/pipermail/security-announce/2010/000082.htmlThird Party Advisory
http://patchwork.ozlabs.org/patch/32830/Patch, Third Party Advisory
http://secunia.com/advisories/37084Third Party Advisory
http://secunia.com/advisories/38794Third Party Advisory
http://secunia.com/advisories/38834Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.6Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.31/ChangeLog-2.6.31-rc9Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2010:198Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/03/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/05/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/06/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/07/2Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/17/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2009/09/17/9Mailing List, Patch, Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1522.htmlThird Party Advisory
http://www.securitytracker.com/id?1023073Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/usn-864-1Third Party Advisory
http://www.vupen.com/english/advisories/2010/0528Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=520990Issue Tracking, Patch, Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6757Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9409Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2009-1540.htmlThird Party Advisory
https://rhn.redhat.com/errata/RHSA-2009-1548.htmlThird Party Advisory

Timeline

Published: Oct 19, 2009
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2009-3228?

How severe is CVE-2009-3228?

Severity scoring for CVE-2009-3228 is pending analysis. The EPSS model estimates a 0.40% probability of exploitation in the next 30 days.

How do I fix CVE-2009-3228?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-3228?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST