National Vulnerability Database (NVD) National Vulnerability Database (CVE-2007-4573)

National Cyber Awareness System

Vulnerability Summary for CVE-2007-4573

Original release date:09/24/2007

Last revised:03/08/2011

Source: US-CERT/NIST

Overview

The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:7.2 (HIGH) (AV:L/AC:L/Au:N/C:C/I:C/A:C) (legend)

Impact Subscore: 10.0

Exploitability Subscore: 3.9

CVSS Version 2 Metrics:

Access Vector: Locally exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type:Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (09/27/2007)

This issue affected users who were running 64-bit versions of Red Hat Enterprise Linux 3, 4, or 5 on x86_64 architecture. It did not affect users of Red Hat Enterprise Linux 2.1. Updates are available for Red Hat Enterprise Linux 3, 4, and 5 to correct this issue. New kernel packages along with our advisory are available at the URL below as well as via the Red Hat Network. http://rhn.redhat.com/errata/CVE-2007-4573.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MLIST

Name: [linux-kernel] 20070921 Linux 2.6.22.7

Type: Patch Information

Hyperlink:http://lkml.org/lkml/2007/9/21/512

External Source: VUPEN

Name: ADV-2007-3246

Hyperlink:http://www.vupen.com/english/advisories/2007/3246

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.7

Hyperlink:http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.7

External Source: OVAL

Name: oval:org.mitre.oval:def:9735

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9735

External Source: FULLDISC

Name: 20070924 COSEINC Linux Advisory #2: IA32 System Call

Hyperlink:http://marc.info/?l=full-disclosure&m=119062587407908&w=2

External Source: MLIST

Name: [linux-kernel] 20070921 Re: Linux 2.6.22.7

Hyperlink:http://lkml.org/lkml/2007/9/21/513

External Source: FEDORA

Name: FEDORA-2007-712

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00355.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1754

Hyperlink:https://issues.rpath.com/browse/RPL-1754

External Source: UBUNTU

Name: USN-518-1

Hyperlink:http://www.ubuntu.com/usn/usn-518-1

External Source: BID

Name: 25774

Hyperlink:http://www.securityfocus.com/bid/25774

External Source: BUGTRAQ

Name: 20070926 Re: COSEINC Linux Advisory #2: IA32 System CallEmulation Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/480705/100/0/threaded

External Source: BUGTRAQ

Name: 20070924 COSEINC Linux Advisory #2: IA32 System Call Emulation Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/480451/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:0938

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0938.html

External Source: REDHAT

Name: RHSA-2007:0937

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0937.html

External Source: REDHAT

Name: RHSA-2007:0936

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0936.html

External Source: SUSE

Name: SUSE-SA:2007:053

Hyperlink:http://www.novell.com/linux/security/advisories/2007_53_kernel.html

External Source: MANDRIVA

Name: MDVSA-2008:105

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:105

External Source: MANDRIVA

Name: MDVSA-2008:008

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:008

External Source: MANDRIVA

Name: MDKSA-2007:196

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:196

External Source: MANDRIVA

Name: MDKSA-2007:195

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:195

External Source: DEBIAN

Name: DSA-1504

Hyperlink:http://www.debian.org/security/2008/dsa-1504

External Source: DEBIAN

Name: DSA-1381

Hyperlink:http://www.debian.org/security/2007/dsa-1381

External Source: DEBIAN

Name: DSA-1378

Hyperlink:http://www.debian.org/security/2007/dsa-1378

External Source: SECTRACK

Name: 1018748

Hyperlink:http://securitytracker.com/id?1018748

External Source: SECUNIA

Name: 29058

Hyperlink:http://secunia.com/advisories/29058

External Source: SECUNIA

Name: 27912

Hyperlink:http://secunia.com/advisories/27912

External Source: SECUNIA

Name: 27227

Hyperlink:http://secunia.com/advisories/27227

External Source: SECUNIA

Name: 27212

Hyperlink:http://secunia.com/advisories/27212

External Source: SECUNIA

Name: 26995

Hyperlink:http://secunia.com/advisories/26995

External Source: SECUNIA

Name: 26994

Hyperlink:http://secunia.com/advisories/26994

External Source: SECUNIA

Name: 26978

Hyperlink:http://secunia.com/advisories/26978

External Source: SECUNIA

Name: 26955

Hyperlink:http://secunia.com/advisories/26955

External Source: SECUNIA

Name: 26953

Hyperlink:http://secunia.com/advisories/26953

External Source: SECUNIA

Name: 26934

Hyperlink:http://secunia.com/advisories/26934

External Source: SECUNIA

Name: 26919

Hyperlink:http://secunia.com/advisories/26919

External Source: SECUNIA

Name: 26917

Hyperlink:http://secunia.com/advisories/26917

External Source: SUSE

Name: SUSE-SA:2007:064

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00001.html

External Source: CONFIRM

Name: http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.35.3

Hyperlink:http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.35.3

External Source: FEDORA

Name: FEDORA-2007-2298

Hyperlink:http://fedoranews.org/updates/FEDORA-2007-229.shtml

References to Check Content

Identifier:oval:org.mitre.oval:def:9735

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9735

Vulnerable software and versions

Configuration 1

* cpe:/o:linux:linux_kernel:2.4.35::x86_64 and previous versions

* cpe:/o:linux:linux_kernel:2.6.22.6::x86_64 and previous versions

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Permissions, Privileges, and Access Control (CWE-264)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4573