Upstream information
Description
The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
| National Vulnerability Database | |
|---|---|
| Base Score | 7.8 |
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | Complete |
| Integrity Impact | None |
| Availability Impact | None |
| National Vulnerability Database | |
|---|---|
| Base Score | 5.5 |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | None |
| Availability Impact | None |
| CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- SUSE-SA:2009:054, published Wed, 11 Nov 2009 15:00:00 +0000
- SUSE-SA:2009:055, published Thu, 12 Nov 2009 19:00:00 +0000
- SUSE-SA:2010:012, published Mon, 15 Feb 2010 16:00:00 +0000
SUSE Timeline for this CVE
CVE page created: Tue Jul 9 17:02:21 2013CVE page last modified: Fri Sep 13 11:16:44 2024