Design/Logic Flaw

2009-09-1810:30:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

Low

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

0.001 Low

EPSS

Percentile

42.2%

JSON

The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function’s tendency to “return the same value over and over again for long stretches of time.”

CPENameOperatorVersion
ubuntu_linuxeq9.04
ubuntu_linuxeq8.10
ubuntu_linuxeq8.04
ubuntu_linuxeq6.06
linux_kernellt2.6.30
opensuseeq11.0
linux_enterprise_desktopeq10 sp2
linux_enterprise_servereq10 sp2

Name	Operator	Version
ubuntu_linux	eq	9.04
ubuntu_linux	eq	8.10
ubuntu_linux	eq	8.04
ubuntu_linux	eq	6.06
linux_kernel	lt	2.6.30
opensuse	eq	11.0
linux_enterprise_desktop	eq	10 sp2
linux_enterprise_server	eq	10 sp2