CVE-2007-3105
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux...
4.6 MediumFix available
CVE-2007-3105 is a medium vulnerability (CVSS 4.6) in Linux Kernel, published July 27, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in linux-2.6 2.6.18.dfsg.1-13etch2.
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.
Exploit likelihood
0.45%Down 1.1 points since Feb 4, 2022
What each source reports
NVD Score used
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.
- Record
CVE-2007-3105- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.
- Record
CVE-2007-3105- Updated
- 2026-11-02
EUVDEUVD-2007-3097 No score
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.
- Record
EUVD-2007-3097- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mvg-22rh-hcjv No score
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux...
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.
- Record
GHSA-8mvg-22rh-hcjv- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2007-3105
CVE-2007-3105 does not affect BellSoft software
- Record
BELL-CVE-2007-3105- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linux-2.6Debian:4.0 |
before 2.6.18.dfsg.1-13etch2, plus listed versions 2.6.18.dfsg.1-122.6.18.dfsg.1-12etch12.6.18.dfsg.1-12etch22.6.18.dfsg.1-132.6.18.dfsg.1-13etch1 |
2.6.18.dfsg.1-13etch2 |
kernel-image-2.6.8-s390Debian:3.1 |
before 2.6.8-6sarge1, plus listed versions 2.6.8-52.6.8-5sarge12.6.8-5sarge22.6.8-5sarge32.6.8-5sarge4 Show 4 moreShow less2.6.8-5sarge52.6.8-5sarge62.6.8-5sarge72.6.8-6 |
2.6.8-6sarge1 |
kernel-image-2.6.8-ia64Debian:3.1 |
before 2.6.8-15sarge1, plus listed versions 2.6.8-142.6.8-14sarge12.6.8-14sarge22.6.8-14sarge32.6.8-14sarge4 Show 4 moreShow less2.6.8-14sarge52.6.8-14sarge62.6.8-14sarge72.6.8-15 |
2.6.8-15sarge1 |
fai-kernelsDebian:3.1 |
before 1.9.1sarge8, plus listed versions 1.9.11.9.1sarge11.9.1sarge21.9.1sarge31.9.1sarge4 Show 4 moreShow less1.9.1sarge51.9.1sarge61.9.1sarge71.9.1sarge7.1 |
1.9.1sarge8 |
kernel-image-2.6.8-amd64Debian:3.1 |
before 2.6.8-17sarge1, plus listed versions 2.6.8-142.6.8-16sarge12.6.8-16sarge22.6.8-16sarge42.6.8-16sarge52.6.8-16sarge62.6.8-16sarge72.6.8-17 |
2.6.8-17sarge1 |
kernel-image-2.6.8-hppaDebian:3.1 |
before 2.6.8-7sarge1, plus listed versions 2.6.8-62.6.8-6sarge12.6.8-6sarge22.6.8-6sarge32.6.8-6sarge4 Show 4 moreShow less2.6.8-6sarge52.6.8-6sarge62.6.8-6sarge72.6.8-7 |
2.6.8-7sarge1 |
kernel-image-2.6.8-sparcDebian:3.1 |
before 2.6.8-16sarge1, plus listed versions 2.6.8-152.6.8-15sarge12.6.8-15sarge22.6.8-15sarge32.6.8-15sarge4 Show 4 moreShow less2.6.8-15sarge52.6.8-15sarge62.6.8-15sarge72.6.8-16 |
2.6.8-16sarge1 |
kernel-image-2.6.8-alphaDebian:3.1 |
before 2.6.8-17sarge1, plus listed versions 2.6.8-162.6.8-16sarge12.6.8-16sarge22.6.8-16sarge32.6.8-16sarge4 Show 4 moreShow less2.6.8-16sarge52.6.8-16sarge62.6.8-16sarge72.6.8-17 |
2.6.8-17sarge1 |
kernel-image-2.6.8-i386Debian:3.1 |
before 2.6.8-17sarge1, plus listed versions 2.6.8-162.6.8-16sarge12.6.8-16sarge22.6.8-16sarge32.6.8-16sarge4 Show 4 moreShow less2.6.8-16sarge52.6.8-16sarge62.6.8-16sarge72.6.8-17 |
2.6.8-17sarge1 |
kernel-source-2.6.8Debian:3.1 |
before 2.6.8-17sarge1, plus listed versions 2.6.8-162.6.8-16sarge12.6.8-16sarge22.6.8-16sarge32.6.8-16sarge4 Show 4 moreShow less2.6.8-16sarge52.6.8-16sarge62.6.8-16sarge72.6.8-17 |
2.6.8-17sarge1 |
Show 75 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-patch-powerpc-2.6.8Debian:3.1 |
before 2.6.8-13sarge1, plus listed versions 2.6.8-122.6.8-12sarge12.6.8-12sarge22.6.8-12sarge32.6.8-12sarge4 Show 4 moreShow less2.6.8-12sarge52.6.8-12sarge62.6.8-12sarge72.6.8-13 |
2.6.8-13sarge1 |
kernel-image-2.6.8-m68kDebian:3.1 |
before 2.6.8-5sarge1, plus listed versions 2.6.8-42.6.8-4sarge12.6.8-4sarge22.6.8-4sarge32.6.8-4sarge4 Show 4 moreShow less2.6.8-4sarge52.6.8-4sarge62.6.8-4sarge72.6.8-5 |
2.6.8-5sarge1 |
kernelRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-develRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-docRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-hugememRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-largesmpRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-smpRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-smp-develRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-xenURed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-xenU-develRed Hat:enterprise_linux:4::as |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernelRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-docRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-hugememRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-largesmpRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-smpRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-smp-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-xenURed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-xenU-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernelRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-develRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-docRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-hugememRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-largesmpRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-smpRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-smp-develRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-xenURed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-xenU-develRed Hat:enterprise_linux:4::es |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernelRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-docRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-hugememRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-largesmpRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-smpRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-smp-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-xenURed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernel-xenU-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-55.0.12.EL | 0:2.6.9-55.0.12.EL |
kernelRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAERed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAE-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAE-develRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-debuginfo-commonRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-develRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-docRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xenRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xen-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xen-develRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernelRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAERed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAE-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAE-develRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-debuginfo-commonRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-develRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-docRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-kdumpRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-kdump-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-kdump-develRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xenRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xen-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xen-develRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
redhat.com/support/errata/RHSA-2007-0940.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10371
secunia.com/advisories/27747
Show 96 moreShow less
novell.com/linux/security/advisories/2007_51_kernel.html
debian.org/security/2007/dsa-1363
issues.rpath.com/browse/RPL-1650
ubuntu.com/usn/usn-510-1
support.avaya.com/elmodocs2/security/ASA-2007-474.htm
securityfocus.com/bid/25348
mandriva.com/security/advisories?name=MDKSA-2007:216
kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.22-git14.log
nvd.nist.gov/vuln/detail/CVE-2007-3105
github.com/advisories/GHSA-8mvg-22rh-hcjv
docs.bell-sw.com/security/cves/CVE-2007-3105
access.redhat.com/errata/RHSA-2007:0939
kbase.redhat.com
bugzilla.redhat.com/show_bug.cgi?id=247726
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0939.json
cve.org/CVERecord?id=CVE-2006-6921