CVE-2007-4573

Status: ModifiedHigh (7.2)—Exploit

Severity7.2High · CVSS 2.0

Exploitation probability0.82 %higher than 57% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB

The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register.

CVSS

Base score: 7.2
Version: 2.0
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.82 %
Percentile among all scored CVEs: 57
Score date: 10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · Linux Kernel 2.4/2.6 (x86-64) - System Call Emulation Privilege Escalation (9/27/2007)
Published on Exploit-DB · Linux Kernel 2.6.x - Ptrace Privilege Escalation (9/21/2007)

Affected technologies (1)

Linux — Linux Kernel

CWEs

CWE-264

References

Show 78 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2007-4573",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-09-24T22:17:00.000",
  "references": [
    {
      "url": "http://fedoranews.org/updates/FEDORA-2007-229.shtml",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.35.3",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00001.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lkml.org/lkml/2007/9/21/512",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lkml.org/lkml/2007/9/21/513",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119062587407908&w=2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/26917",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/26919",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/26934",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/26953",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/26955",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/26978",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/26994",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/26995",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/27212",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/27227",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/27912",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/29058",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://securitytracker.com/id?1018748",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1378",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1381",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1504",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.7",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:195",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:196",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:008",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:105",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.novell.com/linux/security/advisories/2007_53_kernel.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0936.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0937.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0938.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/480451/100/0/threaded",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/480705/100/0/threaded",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/25774",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-518-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3246",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://issues.rpath.com/browse/RPL-1754",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9735",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00355.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://fedoranews.org/updates/FEDORA-2007-229.shtml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.35.3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lkml.org/lkml/2007/9/21/512",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lkml.org/lkml/2007/9/21/513",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=full-disclosure&m=119062587407908&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26917",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26919",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26934",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26953",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26955",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26978",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26994",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26995",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27212",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27227",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27912",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29058",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1018748",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1378",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2007/dsa-1381",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2008/dsa-1504",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:195",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:196",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:008",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:105",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.novell.com/linux/security/advisories/2007_53_kernel.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0936.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0937.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2007-0938.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/480451/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/480705/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/25774",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-518-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3246",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://issues.rpath.com/browse/RPL-1754",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9735",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00355.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de emulación de llamada del sistema IA32 en Linux kernel 2.4.x y 2.6.x versiones anteriores a 2.6.22.7, cuando se ejecuta en arquitecturas x86_64, no extiende a cero el registro eax después de ser usada una ruta de entrada 32bit en ptrace, lo cual podría permitir a usuarios locales, obtener privilegios al disparar un acceso fuera de límites en la tabla de llamadas del sistema utilizando el registro %RAX."
    }
  ],
  "lastModified": "2026-06-16T22:44:21.527",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:x86_64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58EF3270-25F7-44A1-806E-680B6D406B1F",
              "versionEndIncluding": "2.4.35"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:x86_64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6C3F3CA-3C63-40C1-9BE1-27489B5AC24F",
              "versionEndIncluding": "2.6.22.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "This issue affected users who were running 64-bit versions of Red Hat Enterprise Linux 3, 4, or 5 on x86_64 architecture.  It did not affect users of Red Hat Enterprise Linux 2.1. \n\nUpdates are available for Red Hat Enterprise Linux 3, 4, and 5 to correct\nthis issue.  New kernel packages along with our advisory are available at\nthe URL below as well as via the Red Hat Network. http://rhn.redhat.com/errata/CVE-2007-4573.html\n",
      "lastModified": "2007-09-27T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}