The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux…
Priority LOW 11CWE-909Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.
Summary
The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.
Why it matters now
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 2.4.0 to before 2.4.37.6; 2.6.0 to before 2.6.31 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.31:-:*:*:*:*:*:* | 2.6.31 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.31:rc1:*:*:*:*:*:* | 2.6.31 rc1 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.31:rc2:*:*:*:*:*:* | 2.6.31 rc2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.31:rc3:*:*:*:*:*:* | 2.6.31 rc3 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.31:rc4:*:*:*:*:*:* | 2.6.31 rc4 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.31:rc5:*:*:*:*:*:* | 2.6.31 rc5 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.31:rc6:*:*:*:*:*:* | 2.6.31 rc6 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.31:rc7:*:*:*:*:*:* | 2.6.31 rc7 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.31:rc8:*:*:*:*:*:* | 2.6.31 rc8 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.4.37.6; 2.6.0 to before 2.6.31 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.31:-:*:*:*:*:*:* Versions 2.6.31 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc1:*:*:*:*:*:* Versions 2.6.31 rc1 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc2:*:*:*:*:*:* Versions 2.6.31 rc2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc3:*:*:*:*:*:* Versions 2.6.31 rc3 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc4:*:*:*:*:*:* Versions 2.6.31 rc4 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc5:*:*:*:*:*:* Versions 2.6.31 rc5 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc6:*:*:*:*:*:* Versions 2.6.31 rc6 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc7:*:*:*:*:*:* Versions 2.6.31 rc7 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc8:*:*:*:*:*:* Versions 2.6.31 rc8 Vulnerable ·Linux
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* | 6.06 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* | 8.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* | 8.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* | 9.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* | 9.10 | Vulnerable | Canonical |
| cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:5.4:*:*:*:*:*:*:* | 5.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* Versions 8.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* Versions 9.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* Versions 9.10 Vulnerable ·Canonical
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:5.4:*:*:*:*:*:*:* Versions 5.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
Remediation
Red Hat 3 advisories
- RHSA-2009:1548 Released 2009-11-03 · Red Hat rating Importantkernel security and bug fix update
- Red Hat Enterprise Linux (v. 5 server) kernel-2.6.18-164.6.1.el5, kernel-2.6.18-164.6.1.el5.ia64, kernel-PAE-2.6.18-164.6.1.el5 +18
- Red Hat Enterprise Linux Desktop (v. 5 client) kernel-2.6.18-164.6.1.el5, kernel-PAE-2.6.18-164.6.1.el5, kernel-PAE-devel-2.6.18-164.6.1.el5 +8
- RHSA-2009:1540 Released 2009-11-03 · Red Hat rating Importantkernel-rt security, bug fix, and enhancement update
- MRG Realtime for RHEL 5 Server kernel-rt-2.6.24.7-137.el5rt, kernel-rt-debug-2.6.24.7-137.el5rt, kernel-rt-debug-devel-2.6.24.7-137.el5rt +6
- RHSA-2009:1522 Released 2009-10-22 · Red Hat rating Moderatekernel security and bug fix update
- Red Hat Enterprise Linux AS version 4 kernel-2.6.9-89.0.15.EL, kernel-2.6.9-89.0.15.EL.ia64, kernel-2.6.9-89.0.15.EL.ppc64iseries +14
- Red Hat Enterprise Linux Desktop version 4 kernel-2.6.9-89.0.15.EL, kernel-devel-2.6.9-89.0.15.EL, kernel-doc-2.6.9-89.0.15.EL +8
- Red Hat Enterprise Linux ES version 4 kernel-2.6.9-89.0.15.EL, kernel-2.6.9-89.0.15.EL.ia64, kernel-devel-2.6.9-89.0.15.EL +12
- Red Hat Enterprise Linux WS version 4 kernel-2.6.9-89.0.15.EL, kernel-2.6.9-89.0.15.EL.ia64, kernel-devel-2.6.9-89.0.15.EL +12
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| MRG Realtime for RHEL 5 Server | Fixed | RHSA-2009:1540 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2009:1548 |
| Red Hat Enterprise Linux AS version 4 | Fixed | RHSA-2009:1522 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2009:1548 |
| Red Hat Enterprise Linux Desktop version 4 | Fixed | RHSA-2009:1522 |
| Red Hat Enterprise Linux ES version 4 | Fixed | RHSA-2009:1522 |
| Red Hat Enterprise Linux WS version 4 | Fixed | RHSA-2009:1522 |
Timeline
- 2026-10-02 Threatist record created from CVE-2009-3228
- 2026-10-03 Alias added: GHSA-53hx-f3mf-p54c
References
Patch 8
- [oss-security] 20090917 Re: CVE request: kernel: tc: uninitialised kernel memory leak
- [oss-security] 20090916 Re: CVE request: kernel: tc: uninitialised kernel memory leak
- [oss-security] 20090903 CVE request: kernel: tc: uninitialised kernel memory leak
- https://bugzilla.redhat.com/show_bug.cgi?id=520990
- [oss-security] 20090906 Re: CVE request: kernel: tc: uninitialised kernel memory leak
- [oss-security] 20090907 Re: CVE request: kernel: tc: uninitialised kernel memory leak
- [oss-security] 20090905 Re: CVE request: kernel: tc: uninitialised kernel memory leak
- http://patchwork.ozlabs.org/patch/32830/
Advisory 9
Other 4
- http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.6
- http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=096ed17f20affc2db0e307658c69b67433992a7a
- http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.31/ChangeLog-2.6.31-rc9
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=16ebb5e0b36ceadc8186f71d68b0c4fa4b6e781b
Sources
- CVE-2009-3228 · CVE Program
- CVE-2009-3228 · NVD
- FIRST EPSS
- GHSA-53hx-f3mf-p54c · GitHub Advisory Database · CC BY 4.0
- CVE-2009-3228 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences