On x86_64 platform the Linux kernel supports compatibility emulation for IA32 userland applications providing 32-bit system calls amongst other 32-bit resources.
As a result of arch/x86_64/ia32/ia32entry.S code optimization invalid opcodes was used in the low level assembler routines providing insufficient validation of %RAX register in the following part of code (2.6):
Improperly validated 64-bit values stored in the %RAX register may lead to out-of-bounds system call table access resulting in the ability to execute arbitrary code in the context of the Linux kernel.
Impact:
Unprivileged local user may execute arbitrary code in the context of the Linux kernel running on x86_64 platform.
Disclosure timeline:
18th September 2007 - Vendor notification
24th September 2007 - Public disclosure
