Description
The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-19lenny2 | DSA-1927-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-26etch1 | DSA-1929-1 |
| Debian 4.0 | linux-2.6.24 | 2.6.24-6~etchnhalf.9etch1 | DSA-1928-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-164.6.1.el5 | RHSA-2009:1548 |
| RHEL 4 | kernel +10 | 2.6.9-89.0.15.EL | RHSA-2009:1522 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-137.el5rt | RHSA-2009:1540 |
Advisories 6
- RHSA-2009:1548 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1540 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1522 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1929-1 linux-2.6 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1927-1 linux-2.6 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1928-1 linux-2.6.24 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20090917 Re: CVE request: kernel: tc: uninitialised kernel memory leak mailing-list
- [oss-security] 20090916 Re: CVE request: kernel: tc: uninitialised kernel memory leak mailing-list
- RHSA-2009:1540 vendor-advisory
- USN-864-1 vendor-advisory
- 38794 third-party-advisory
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates mailing-list
- MDVSA-2010:198 vendor-advisory
- [oss-security] 20090903 CVE request: kernel: tc: uninitialised kernel memory leak mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=520990
- 37084 third-party-advisory
- RHSA-2009:1522 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.6
- oval:org.mitre.oval:def:9409 vdb-entry signature
- http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=096ed17f20affc2db0e307658c69b67433992a7a
- RHSA-2009:1548 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.31/ChangeLog-2.6.31-rc9
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=16ebb5e0b36ceadc8186f71d68b0c4fa4b6e781b
- 38834 third-party-advisory
- [oss-security] 20090906 Re: CVE request: kernel: tc: uninitialised kernel memory leak mailing-list
- [oss-security] 20090907 Re: CVE request: kernel: tc: uninitialised kernel memory leak mailing-list
- [oss-security] 20090905 Re: CVE request: kernel: tc: uninitialised kernel memory leak mailing-list
- 1023073 vdb-entry
- http://patchwork.ozlabs.org/patch/32830/
- oval:org.mitre.oval:def:6757 vdb-entry signature
- ADV-2010-0528 vdb-entry