PT-2019-6490 · Linux · Linux

Published 2019-11-07 · Updated 2019-11-12 · CVE-2007-3732

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux versions prior to 2.6.23

Description The issue arises from the TRACE IRQS ON function in iret exc, which calls a C function without properly setting the segments. Specifically, the kernel's %fs needs to be restored before the call in TRACE IRQS ON and before enabling interrupts, to ensure that "current" references work correctly. Without this restoration, using "current" between iret exc and the middle of error code, where %fs is reset, would result in a crash.

Recommendations For Linux versions prior to 2.6.23, update to version 2.6.23 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-3732

Affected Products

Linux

References · 8

• https://osv.dev/vulnerability/UBUNTU-CVE-2007-3732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3732 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2007-3732 · Patch
• https://ubuntu.com/security/CVE-2007-3732 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2007-3732 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-3732 · Vendor Advisory
• https://t.me/cibsecurity/7987 · Telegram Post
• https://access.redhat.com/security/cve/cve-2007-3732 · Note