CVE-2009-3228

The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.

Weakness

The product does not initialize a critical resource.

Affected Software

Name	Vendor	Start Version	End Version
Linux_kernel	Linux	2.4.0 (including)	2.4.37.6 (excluding)
Linux_kernel	Linux	2.6.0 (including)	2.6.31 (excluding)
Linux_kernel	Linux	2.6.31 (including)	2.6.31 (including)
Linux_kernel	Linux	2.6.31-rc1 (including)	2.6.31-rc1 (including)
Linux_kernel	Linux	2.6.31-rc2 (including)	2.6.31-rc2 (including)
Linux_kernel	Linux	2.6.31-rc3 (including)	2.6.31-rc3 (including)
Linux_kernel	Linux	2.6.31-rc4 (including)	2.6.31-rc4 (including)
Linux_kernel	Linux	2.6.31-rc5 (including)	2.6.31-rc5 (including)
Linux_kernel	Linux	2.6.31-rc6 (including)	2.6.31-rc6 (including)
Linux_kernel	Linux	2.6.31-rc7 (including)	2.6.31-rc7 (including)
Linux_kernel	Linux	2.6.31-rc8 (including)	2.6.31-rc8 (including)
MRG for RHEL-5	RedHat	kernel-rt-0:2.6.24.7-137.el5rt	*
Red Hat Enterprise Linux 4	RedHat	kernel-0:2.6.9-89.0.15.EL	*
Red Hat Enterprise Linux 5	RedHat	kernel-0:2.6.18-164.6.1.el5	*
Linux	Ubuntu	hardy	*
Linux	Ubuntu	intrepid	*
Linux	Ubuntu	jaunty	*
Linux	Ubuntu	upstream	*
Linux-source-2.6.15	Ubuntu	dapper	*
Linux-source-2.6.15	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2009-3228
CWE	https://cwe.mitre.org/data/definitions/909.html

Missing Initialization of Resource

Weakness

Affected Software

Potential Mitigations

References