Vulnerability Description
In Linux 2.6 before 2.6.23, the TRACE_IRQS_ON function in iret_exc calls a C function without ensuring that the segments are set properly. The kernel's %fs needs to be restored before the call in TRACE_IRQS_ON and before enabling interrupts, so that "current" references work. Without this, "current" used in the window between iret_exc and the middle of error_code where %fs is reset, would crash.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 2.6.0, < 2.6.23 |
References
- https://access.redhat.com/security/cve/cve-2007-3732Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2007-3732Issue TrackingPatchThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2007-3732Third Party Advisory
- https://access.redhat.com/security/cve/cve-2007-3732Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2007-3732Issue TrackingPatchThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2007-3732Third Party Advisory
FAQ
What is CVE-2007-3732?
CVE-2007-3732 is a vulnerability with a CVSS score of 5.5 (MEDIUM). In Linux 2.6 before 2.6.23, the TRACE_IRQS_ON function in iret_exc calls a C function without ensuring that the segments are set properly. The kernel's %fs needs to be restored before the call in TRAC...
How severe is CVE-2007-3732?
CVE-2007-3732 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-3732?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.