TI-2009-03083 Aliases CVE-2009-3238 GHSA-gq5x-hvxj-cp4r

The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30…

LOW 28CWE-338Published 2009-09-18 · Updated 2024-08-07

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."

Why it matters now

EPSS 0.01632 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	before 2.6.30	Vulnerable	Linux
cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*	6.06	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:8.04::::-:::	8.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::*	8.10	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::*	9.04	Vulnerable	Canonical
cpe:2.3:o:opensuse:opensuse:11.0:::::::*	11.0	Vulnerable	openSUSE
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2::::::	10 sp2	Vulnerable	SUSE
cpe:2.3:o:suse:linux_enterprise_server:10:sp2::::::	10 sp2	Vulnerable	SUSE

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 2.6.30 Vulnerable ·Linux
cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* Versions 8.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* Versions 9.04 Vulnerable ·Canonical
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·openSUSE
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:* Versions 10 sp2 Vulnerable ·SUSE
cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:* Versions 10 sp2 Vulnerable ·SUSE

Remediation

Red Hat 3 advisories

RHSA-2009:1438 Released 2009-09-15 · Red Hat rating Important
kernel security and bug fix update
- Red Hat Enterprise Linux AS version 4 kernel-2.6.9-89.0.11.EL, kernel-2.6.9-89.0.11.EL.ia64, kernel-2.6.9-89.0.11.EL.ppc64iseries +14
- Red Hat Enterprise Linux Desktop version 4 kernel-2.6.9-89.0.11.EL, kernel-devel-2.6.9-89.0.11.EL, kernel-doc-2.6.9-89.0.11.EL +8
- Red Hat Enterprise Linux ES version 4 kernel-2.6.9-89.0.11.EL, kernel-2.6.9-89.0.11.EL.ia64, kernel-devel-2.6.9-89.0.11.EL +12
- Red Hat Enterprise Linux WS version 4 kernel-2.6.9-89.0.11.EL, kernel-2.6.9-89.0.11.EL.ia64, kernel-devel-2.6.9-89.0.11.EL +12
RHSA-2009:1106 Released 2009-06-16 · Red Hat rating Important
kernel security and bug fix update
- Red Hat Enterprise Linux (v. 5 server) kernel-2.6.18-128.1.14.el5, kernel-2.6.18-128.1.14.el5.ia64, kernel-PAE-2.6.18-128.1.14.el5 +18
- Red Hat Enterprise Linux Desktop (v. 5 client) kernel-2.6.18-128.1.14.el5, kernel-PAE-2.6.18-128.1.14.el5, kernel-PAE-devel-2.6.18-128.1.14.el5 +8
RHSA-2009:1081 Released 2009-06-03 · Red Hat rating Important
kernel-rt security and bug fix update
- MRG Realtime for RHEL 5 Server kernel-rt-2.6.24.7-117.el5rt, kernel-rt-debug-2.6.24.7-117.el5rt, kernel-rt-debug-devel-2.6.24.7-117.el5rt +6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
MRG Realtime for RHEL 5 Server	Fixed	RHSA-2009:1081
Red Hat Enterprise Linux (v. 5 server)	Fixed	RHSA-2009:1106
Red Hat Enterprise Linux AS version 4	Fixed	RHSA-2009:1438
Red Hat Enterprise Linux Desktop (v. 5 client)	Fixed	RHSA-2009:1106
Red Hat Enterprise Linux Desktop version 4	Fixed	RHSA-2009:1438
Red Hat Enterprise Linux ES version 4	Fixed	RHSA-2009:1438
Red Hat Enterprise Linux WS version 4	Fixed	RHSA-2009:1438

Timeline

2026-10-02 Threatist record created from CVE-2009-3238
2026-10-03 Alias added: GHSA-gq5x-hvxj-cp4r

References

Exploit 1

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30

Patch 1

http://patchwork.kernel.org/patch/21766/

Advisory 5

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences