Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 289918 (CVE-2009-3612)

Summary: Kernel: tfc_fill_node() tcm__pad2 infomation disclosure (CVE-2009-3612)
Product: Gentoo Security Reporter: Alex Legler (RETIRED) <a3li>
Component: KernelAssignee: Gentoo Security <security>
Severity: normal CC: hardened-kernel+disabled, kernel
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: [linux <] [linux >=2.6.28 <] [gp <2.6.31-7]
Package list:
Runtime testing required: ---

Description Alex Legler (RETIRED) archtester gentoo-dev Security 2009-10-20 22:01:24 UTC
CVE-2009-3612 (
  The tcf_fill_node function in net/sched/cls_api.c in the netlink
  subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and
  and earlier, does not initialize a certain tcm__pad2 structure
  member, which might allow local users to obtain sensitive information
  from kernel memory via unspecified vectors.  NOTE: this issue exists
  because of an incomplete fix for CVE-2005-4881.