CVE-2007-4573

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-09-24 · updated 2026-06-16
Weakness: CWE-264

Description

The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register.

Affected products

Linux kernel: through 2.4.35; through 2.6.22.6

References

http://fedoranews.org/updates/FEDORA-2007-229.shtml
http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.35.3
http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00001.html
http://lkml.org/lkml/2007/9/21/512
http://lkml.org/lkml/2007/9/21/513
http://marc.info/?l=full-disclosure&m=119062587407908&w=2
http://secunia.com/advisories/26917
http://secunia.com/advisories/26919
http://secunia.com/advisories/26934
http://secunia.com/advisories/26953
http://secunia.com/advisories/26955
http://secunia.com/advisories/26978

Get alerted when CVE-2007-4573 or the next vulnerability affects your stack