CVE-2010-3301
High
Description
The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Linux Kernel
PublishedSep 22, 2010
First seenSep 22, 2010
How to fix
Update
- linux linux_kernel2.6.36 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | v < 2.6.36, 2.6.36 | 2.6.36 |
| suse linux_enterprise_real_time_extension | 11 | — |
| canonical ubuntu_linux | 9.10, 10.04, 10.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.