What is CVE-2007-4311?

CVE-2007-4311 is a Medium severity Linux kernel vulnerability with a CVSS score of 6.8 out of 10. CVE-2007-4311 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2007-4311?

CVE-2007-4311 has a CVSS score of 6.8 out of 10, rated Medium severity. The vector string is AV:N/AC:M/Au:N/C:P/I:P/A:P.

Is there a patch available for CVE-2007-4311?

No patch is currently available for CVE-2007-4311. Monitor the NIST NVD and your Linux distribution's security advisories for updates.

Is CVE-2007-4311 actively exploited?

CVE-2007-4311 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2007-4311

Medium

The xfer_secondary_pool function in drivers/char/random.c in the Linux kernel 2.4 before 2.4.35 performs reseed operations on only the first few bytes of a buffer, which might make it easier for attackers to predict the output of the random number generator, related to incorrect use of the sizeof operator.

Package Linux Kernel

Published 2007-08-13

Last modified 2026-04-23

CVSS version 2.0

Patch available

Awaiting data

CVSS 2.0 score

6.8

out of 10

Medium

Attack Vector

Network

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Vector string

AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness type

CWE-310

CVE-2007-4311 is classified as CWE-310

See CWE-310 on MITRE CWE for full details on this weakness type.

References

The following references provide additional information about CVE-2007-4311 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.

Secunia
http://secunia.com/advisories/29058

Vendor Advisory
Debian Security
http://www.debian.org/security/2008/dsa-1503
Kernel.org
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.34.6
Kernel.org
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.35
Securityfocus
http://www.securityfocus.com/bid/25029
Vupen
http://www.vupen.com/english/advisories/2007/2690

Vendor Advisory
Kernel patch commit
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.34.y.git%3Ba=commit%3Bh=bd67d4c7b11cc33ebdc346bc8926d255b354cd64
Patch
Kernel patch commit
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.34.y.git%3Ba=commit%3Bh=faa3369ac2ea7feb0dd266b6a5e8d6ab153cf925
Patch

Details

CVE ID CVE-2007-4311

Severity Medium

CVSS score 6.8 / 10

CVSS version 2.0

Published 2007-08-13

Modified 2026-04-23

KEV No

Patch Awaiting data

Package linux

Frequently asked questions

What is CVE-2007-4311?

CVE-2007-4311 is a Medium severity Linux kernel vulnerability with a CVSS score of 6.8 out of 10 . CVE-2007-4311 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2007-4311?

CVE-2007-4311 has a CVSS score of 6.8 out of 10, rated Medium severity (CVSS 2.0). The vector string is AV:N/AC:M/Au:N/C:P/I:P/A:P.
Is there a patch available for CVE-2007-4311?

No patch is currently available for CVE-2007-4311. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
Is CVE-2007-4311 actively exploited?

No — CVE-2007-4311 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.