The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux…
Priority LOW 11CWE-200Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.
Why it matters now
EPSS 0.00399 34th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | up to 2.4.37.6; 2.6.0 to before 2.6.32 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.32:-:*:*:*:*:*:* | 2.6.32 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.32:rc1:*:*:*:*:*:* | 2.6.32 rc1 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.32:rc2:*:*:*:*:*:* | 2.6.32 rc2 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.32:rc3:*:*:*:*:*:* | 2.6.32 rc3 | Vulnerable | Linux |
| cpe:2.3:o:linux:linux_kernel:2.6.32:rc4:*:*:*:*:*:* | 2.6.32 rc4 | Vulnerable | Linux |
| cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | openSUSE |
| cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:* | 10 sp2 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3:*:*:*:*:*:* | 10 sp3 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:* | 10 sp2 | Vulnerable | SUSE |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions up to 2.4.37.6; 2.6.0 to before 2.6.32 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.32:-:*:*:*:*:*:* Versions 2.6.32 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.32:rc1:*:*:*:*:*:* Versions 2.6.32 rc1 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.32:rc2:*:*:*:*:*:* Versions 2.6.32 rc2 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.32:rc3:*:*:*:*:*:* Versions 2.6.32 rc3 Vulnerable ·Linux
- cpe:2.3:o:linux:linux_kernel:2.6.32:rc4:*:*:*:*:*:* Versions 2.6.32 rc4 Vulnerable ·Linux
- cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·openSUSE
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:* Versions 10 sp2 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3:*:*:*:*:*:* Versions 10 sp3 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:* Versions 10 sp2 Vulnerable ·SUSE
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:*:*:*:* | 10 sp3 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp2:*:*:*:*:*:* | 10 sp2 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3:*:*:*:*:*:* | 10 sp3 | Vulnerable | SUSE |
| cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* | 6.06 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* | 8.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* | 8.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* | 9.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* | 9.10 | Vulnerable | Canonical |
| cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:* | 10 | Vulnerable | Fedoraproject |
- cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:*:*:*:* Versions 10 sp3 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp2:*:*:*:*:*:* Versions 10 sp2 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3:*:*:*:*:*:* Versions 10 sp3 Vulnerable ·SUSE
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* Versions 8.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* Versions 9.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* Versions 9.10 Vulnerable ·Canonical
- cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Fedoraproject
Remediation
Red Hat 3 advisories
- RHSA-2009:1670 Released 2009-12-15 · Red Hat rating Importantkernel security and bug fix update
- Red Hat Enterprise Linux (v. 5 server) kernel-2.6.18-164.9.1.el5, kernel-2.6.18-164.9.1.el5.ia64, kernel-PAE-2.6.18-164.9.1.el5 +18
- Red Hat Enterprise Linux Desktop (v. 5 client) kernel-2.6.18-164.9.1.el5, kernel-PAE-2.6.18-164.9.1.el5, kernel-PAE-devel-2.6.18-164.9.1.el5 +8
- RHSA-2009:1540 Released 2009-11-03 · Red Hat rating Importantkernel-rt security, bug fix, and enhancement update
- MRG Realtime for RHEL 5 Server kernel-rt-2.6.24.7-137.el5rt, kernel-rt-debug-2.6.24.7-137.el5rt, kernel-rt-debug-devel-2.6.24.7-137.el5rt +6
- RHSA-2009:1522 Released 2009-10-22 · Red Hat rating Moderatekernel security and bug fix update
- Red Hat Enterprise Linux AS version 4 kernel-2.6.9-89.0.15.EL, kernel-2.6.9-89.0.15.EL.ia64, kernel-2.6.9-89.0.15.EL.ppc64iseries +14
- Red Hat Enterprise Linux Desktop version 4 kernel-2.6.9-89.0.15.EL, kernel-devel-2.6.9-89.0.15.EL, kernel-doc-2.6.9-89.0.15.EL +8
- Red Hat Enterprise Linux ES version 4 kernel-2.6.9-89.0.15.EL, kernel-2.6.9-89.0.15.EL.ia64, kernel-devel-2.6.9-89.0.15.EL +12
- Red Hat Enterprise Linux WS version 4 kernel-2.6.9-89.0.15.EL, kernel-2.6.9-89.0.15.EL.ia64, kernel-devel-2.6.9-89.0.15.EL +12
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| MRG Realtime for RHEL 5 Server | Fixed | RHSA-2009:1540 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2009:1670 |
| Red Hat Enterprise Linux AS version 4 | Fixed | RHSA-2009:1522 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2009:1670 |
| Red Hat Enterprise Linux Desktop version 4 | Fixed | RHSA-2009:1522 |
| Red Hat Enterprise Linux ES version 4 | Fixed | RHSA-2009:1522 |
| Red Hat Enterprise Linux WS version 4 | Fixed | RHSA-2009:1522 |
Timeline
- 2026-10-02 Threatist record created from CVE-2009-3612
- 2026-10-03 Alias added: GHSA-vr55-mp4p-wfh2
References
Advisory 16
- RHSA-2009:1540
- SUSE-SA:2009:061
- USN-864-1
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates
- [oss-security] 20091014 CVE request kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7
- MDVSA-2009:329
- SUSE-SA:2010:012
- [oss-security] 20091014 Re: CVE request kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7
- RHSA-2009:1670
- SUSE-SA:2009:064
- [oss-security] 20091014 Re: CVE request: kernel: tc: uninitialised kernel memory leak
- [oss-security] 20091015 Re: CVE request kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7
- oval:org.mitre.oval:def:10395
- oval:org.mitre.oval:def:7557
- FEDORA-2009-11038
- ADV-2010-0528
Sources
- CVE-2009-3612 · CVE Program
- CVE-2009-3612 · NVD
- FIRST EPSS
- GHSA-vr55-mp4p-wfh2 · GitHub Advisory Database · CC BY 4.0
- CVE-2009-3612 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences