CVE-2009-3238

The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."

• CWE-338

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8a0a9bd4db63bc45e3017bedeafbd88d0eb84d02Broken Link
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlMailing List
• http://patchwork.kernel.org/patch/21766/Broken Link, Patch
• http://secunia.com/advisories/37105Broken Link
• http://secunia.com/advisories/37351Broken Link
• http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30Broken Link, Exploit, Vendor Advisory
• http://www.redhat.com/support/errata/RHSA-2009-1438.htmlBroken Link
• http://www.ubuntu.com/usn/USN-852-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=499785Issue Tracking, Permissions Required
• https://bugzilla.redhat.com/show_bug.cgi?id=519692Issue Tracking, Permissions Required
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11168Broken Link
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03836en_usThird Party Advisory
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8a0a9bd4db63bc45e3017bedeafbd88d0eb84d02Broken Link
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlMailing List
• http://patchwork.kernel.org/patch/21766/Broken Link, Patch
• http://secunia.com/advisories/37105Broken Link
• http://secunia.com/advisories/37351Broken Link
• http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30Broken Link, Exploit, Vendor Advisory
• http://www.redhat.com/support/errata/RHSA-2009-1438.htmlBroken Link
• http://www.ubuntu.com/usn/USN-852-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=499785Issue Tracking, Permissions Required
• https://bugzilla.redhat.com/show_bug.cgi?id=519692Issue Tracking, Permissions Required
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11168Broken Link
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03836en_usThird Party Advisory

Published

Sep 18, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3232pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and…
• CVE-2009-3233changetrack 4.3 allows local users to execute arbitrary comm…
• CVE-2009-3234Buffer overflow in the perf_copy_attr function in kernel/per…
• CVE-2009-3235Multiple stack-based buffer overflows in the Sieve plugin in…
• CVE-2009-3236The form library in Horde Application Framework 3.2 before 3…
• CVE-2009-3237Multiple cross-site scripting (XSS) vulnerabilities in Horde…
• CVE-2009-3239Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2009-3240Cross-site scripting (XSS) vulnerability in the Happy Linux …
• CVE-2009-3241Unspecified vulnerability in the OpcUa (OPC UA) dissector in…
• CVE-2009-3242Unspecified vulnerability in packet.c in the GSM A RR dissec…
• CVE-2009-3243Unspecified vulnerability in the TLS dissector in Wireshark …
• CVE-2009-3244Heap-based buffer overflow in the SwDir.dll ActiveX control …