[kernel-sec-discuss] r1524 - active

[Michael Gilbert]

Author: gilbert-guest
Date: 2009-10-19 21:23:10 +0000 (Mon, 19 Oct 2009)
New Revision: 1524

Added:
   active/CVE-2009-3238
Log:
new issue

Added: active/CVE-2009-3238
===================================================================
--- active/CVE-2009-3238	                        (rev 0)
+++ active/CVE-2009-3238	2009-10-19 21:23:10 UTC (rev 1524)
@@ -0,0 +1,20 @@
+Candidate: CVE-2009-3238
+Description:
+ The get_random_int function in drivers/char/random.c in the Linux kernel before 
+ 2.6.30 produces insufficiently random numbers, which allows attackers to predict the 
+ return value, and possibly defeat protection mechanisms based on randomization, via 
+ vectors that leverage the function's tendency to "return the same value over and
+ over again for long stretches of time."
+References:
+ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3238
+ http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8a0a9bd4db63bc45e3017bedeafbd88d0eb84d02
+ http://patchwork.kernel.org/patch/21766/
+ https://bugzilla.redhat.com/show_bug.cgi?id=499785
+ https://bugzilla.redhat.com/show_bug.cgi?id=519692
+Notes:
+Bugs:
+upstream: released (2.6.30) [8a0a9bd4db63bc45e3017bedeafbd88d0eb84d02]
+linux-2.6: released (2.6.30-1)
+2.6.18-etch-security: needed
+2.6.24-etch-security: needed
+2.6.26-lenny-security: needed