Description
The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
Scores
CVSS v3
5.5
EPSS
0.0024
EPSS Percentile
47.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-338
Status
published
Products (8)
canonical/ubuntu_linux
6.06
canonical/ubuntu_linux
8.04
canonical/ubuntu_linux
8.10
canonical/ubuntu_linux
9.04
linux/linux_kernel
< 2.6.30
opensuse/opensuse
11.0
suse/linux_enterprise_desktop
10 sp2
suse/linux_enterprise_server
10 sp2
Published
Sep 18, 2009
Tracked Since
Feb 18, 2026