Linux Kernel IA32 System Call Lets Local Users Gain Elevated Privileges

Impact:  Root access via local system
Fix Available:  Yes   Vendor Confirmed:  Yes 
Version(s): prior to 2.6.22.7
Description:  A vulnerability was reported in the Linux Kernel, affecting the x86_64 architecture. A local user can obtain root privileges on the target system.

网管u家u.bitscn@com

The IA32 system call emulation function on AMD64 and Intel 64 platforms does not properly validate the %RAX register. A local user may be able to exploit this to access the system call table and execute arbitrary commands on the target system with root privileges.

中国网管联盟bitsCN.com

The vendor was notified on September 18, 2007.

Wojciech Purczynski of COSEINC PTE Ltd. and iSEC Security Research reported this vulnerability.
Impact:  A local user can obtain root privileges on the target system.
Solution:  The vendor has issued a fixed version (2.6.22.7).
Vendor URL:  www.kernel.org/ (Links to External Site)
Cause:  Access control error
Underlying OS:  Linux (Caldera/SCO), Linux (Conectiva), Linux (Debian), Linux (EnGarde), Linux (Gentoo), Linux (HP Secure OS), Linux (Immunix), Linux (Mandriva/Mandrake), Linux (Progeny Debian), Linux (Red Hat Enterprise), Linux (Red Hat Fedora), Linux (Red Hat Linux), Linux (SGI), Linux (Slackware), Linux (Sun), Linux (SuSE), Linux (Trustix), Linux (Turbo Linux), Linux (Ubuntu), Linux (Xandros) 网管u家www.bitscn.net
Reported By:  Wojciech Purczynski <cliph@isec.pl>
Message History:   This archive entry has one or more follow-up message(s) listed below.
Sep 28 2007  (Red Hat Issues Fix) Linux Kernel IA32 System Call Lets Local Users Gain Elevated Privileges   (bugzilla@redhat.com)
Red Hat has released a fix for Red Hat Enterprise Linux 5.
Sep 28 2007  (Red Hat Issues Fix) Linux Kernel IA32 System Call Lets Local Users Gain Elevated Privileges   (bugzilla@redhat.com)
Red Hat has released a fix for Red Hat Enterprise Linux 4.
Sep 28 2007  (Red Hat Issues Fix) Linux Kernel IA32 System Call Lets Local Users Gain Elevated Privileges   (bugzilla@redhat.com)
Red Hat has released a fix for Red Hat Enterprise Linux 3. 网管u家u.bitscn@com