CVE-2010-3301
7.5 High
AI Score
Confidence
High
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.0004 Low
EPSS
Percentile
0.4%
The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression.
References
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=36d001c70d8a0144ac1d038f6876c484849a74de
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=eefdca043e8391dcd719711716492063030b55ac
lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
secunia.com/advisories/42758
sota.gen.nz/compat2/
www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.log
www.mandriva.com/security/advisories?name=MDVSA-2010:198
www.mandriva.com/security/advisories?name=MDVSA-2010:247
www.openwall.com/lists/oss-security/2010/09/16/1
www.openwall.com/lists/oss-security/2010/09/16/3
www.redhat.com/support/errata/RHSA-2010-0842.html
www.ubuntu.com/usn/USN-1041-1
www.vupen.com/english/advisories/2010/3117
www.vupen.com/english/advisories/2011/0070
www.vupen.com/english/advisories/2011/0298
bugzilla.redhat.com/show_bug.cgi?id=634449
Social References
More
Related
7.5 High
AI Score
Confidence
High
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.0004 Low
EPSS
Percentile
0.4%