CVE-2009-3612

Linux Kernel < 2.4.37.6 and 2.6.x < 2.6.32-rc5 - Information Disclosure via Uninitialized tcm__pad2 Structure

Title source: llm
STIX 2.1

Description

The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.

References (24)

Core 24
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://rhn.redhat.com/errata/RHSA-2009-1540.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-864-1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/10/14/2
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2009:329
Patch, Third Party Advisory x_refsource_confirm
http://patchwork.ozlabs.org/patch/35412/
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/38794
Third Party Advisory mailing-list x_refsource_mlist
http://lists.vmware.com/pipermail/security-announce/2010/000082.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/10/15/1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37909
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-1670.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/38834
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/10/14/1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/10/15/3
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=528868
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37086
Third Party Advisory vendor-advisory x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00190.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/0528

Scores

EPSS 0.0007
EPSS Percentile 22.3%

Details

CWE
CWE-200
Status published
Products (12)
canonical/ubuntu_linux 6.06
canonical/ubuntu_linux 8.04
canonical/ubuntu_linux 8.10
canonical/ubuntu_linux 9.04
canonical/ubuntu_linux 9.10
fedoraproject/fedora 10
linux/linux_kernel 2.6.32 (5 CPE variants)
linux/linux_kernel < 2.4.37.6
opensuse/opensuse 11.0
suse/linux_enterprise_desktop 10 sp2 (2 CPE variants)
... and 2 more
Published Oct 19, 2009
Tracked Since Feb 18, 2026