01 Record

CVE-2009-3228

The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.39% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 33.6% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-16.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2009-10-19 19:27Z17 YR AGO

Last updated

2024-08-07 06:22Z2 YR AGO

Reserved

2009-09-16

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-909Missing Initialization of ResourceClass
CWE-401Missing Release of Memory after Effective LifetimeVariant

Data version

5.1

Document digest

690234428e69b9225aff2f76560859a2d0ad0fb8dbef6b4d4c9432db36e51759

05 Affected products

VendorProductVersionsPlatforms

canonicalubuntu_linuxNot specified—

linuxlinux_kernelNot specified—

redhatenterprise_linuxNot specified—

redhatenterprise_linux_desktopNot specified—

redhatenterprise_linux_eusNot specified—

redhatenterprise_linux_serverNot specified—

redhatenterprise_linux_workstationNot specified—

redhatenterprise_mrgNot specified—

06 References

www.openwall.com[oss-security] 20090917 Re: CVE request: kernel: tc: uninitialised kernel memory leakhttp://www.openwall.com/lists/oss-security/2009/09/17/9mailing-listx_refsource_MLIST
www.openwall.com[oss-security] 20090916 Re: CVE request: kernel: tc: uninitialised kernel memory leakhttp://www.openwall.com/lists/oss-security/2009/09/17/1mailing-listx_refsource_MLIST
rhn.redhat.comRHSA-2009:1540https://rhn.redhat.com/errata/RHSA-2009-1540.htmlvendor-advisoryx_refsource_REDHAT
www.ubuntu.comUSN-864-1http://www.ubuntu.com/usn/usn-864-1vendor-advisoryx_refsource_UBUNTU
secunia.com38794http://secunia.com/advisories/38794third-party-advisoryx_refsource_SECUNIA
lists.vmware.com[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updateshttp://lists.vmware.com/pipermail/security-announce/2010/000082.htmlmailing-listx_refsource_MLIST
www.mandriva.comMDVSA-2010:198http://www.mandriva.com/security/advisories?name=MDVSA-2010:198vendor-advisoryx_refsource_MANDRIVA
www.openwall.com[oss-security] 20090903 CVE request: kernel: tc: uninitialised kernel memory leakhttp://www.openwall.com/lists/oss-security/2009/09/03/1mailing-listx_refsource_MLIST
bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=520990x_refsource_CONFIRM
secunia.com37084http://secunia.com/advisories/37084third-party-advisoryx_refsource_SECUNIA
www.redhat.comRHSA-2009:1522http://www.redhat.com/support/errata/RHSA-2009-1522.htmlvendor-advisoryx_refsource_REDHAT
www.kernel.orghttp://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.6x_refsource_CONFIRM
oval.cisecurity.orgoval:org.mitre.oval:def:9409https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9409vdb-entrysignaturex_refsource_OVAL
git.kernel.orghttp://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=096ed17f20affc2db0e307658c69b67433992a7ax_refsource_CONFIRM
rhn.redhat.comRHSA-2009:1548https://rhn.redhat.com/errata/RHSA-2009-1548.htmlvendor-advisoryx_refsource_REDHAT
www.kernel.orghttp://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.31/ChangeLog-2.6.31-rc9x_refsource_CONFIRM
git.kernel.orghttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=16ebb5e0b36ceadc8186f71d68b0c4fa4b6e781bx_refsource_CONFIRM
secunia.com38834http://secunia.com/advisories/38834third-party-advisoryx_refsource_SECUNIA
www.openwall.com[oss-security] 20090906 Re: CVE request: kernel: tc: uninitialised kernel memory leakhttp://www.openwall.com/lists/oss-security/2009/09/06/2mailing-listx_refsource_MLIST
www.openwall.com[oss-security] 20090907 Re: CVE request: kernel: tc: uninitialised kernel memory leakhttp://www.openwall.com/lists/oss-security/2009/09/07/2mailing-listx_refsource_MLIST
www.openwall.com[oss-security] 20090905 Re: CVE request: kernel: tc: uninitialised kernel memory leakhttp://www.openwall.com/lists/oss-security/2009/09/05/2mailing-listx_refsource_MLIST
www.securitytracker.com1023073http://www.securitytracker.com/id?1023073vdb-entryx_refsource_SECTRACK
patchwork.ozlabs.orghttp://patchwork.ozlabs.org/patch/32830/x_refsource_CONFIRM
oval.cisecurity.orgoval:org.mitre.oval:def:6757https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6757vdb-entrysignaturex_refsource_OVAL
www.vupen.comADV-2010-0528http://www.vupen.com/english/advisories/2010/0528vdb-entryx_refsource_VUPEN