CVE-2010-3301

The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression.

• CWE-269

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=36d001c70d8a0144ac1d038f6876c484849a74de
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=eefdca043e8391dcd719711716492063030b55ac
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlMailing List, Third Party Advisory
• http://secunia.com/advisories/42758Third Party Advisory
• http://sota.gen.nz/compat2/Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.logBroken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:198Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:247Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/09/16/1Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/09/16/3Mailing List, Patch, Third Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0842.htmlThird Party Advisory
• http://www.ubuntu.com/usn/USN-1041-1Third Party Advisory
• http://www.vupen.com/english/advisories/2010/3117Third Party Advisory
• http://www.vupen.com/english/advisories/2011/0070Third Party Advisory
• http://www.vupen.com/english/advisories/2011/0298Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=634449Exploit, Issue Tracking, Third Party Advisory
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=36d001c70d8a0144ac1d038f6876c484849a74de
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=eefdca043e8391dcd719711716492063030b55ac
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlMailing List, Third Party Advisory
• http://secunia.com/advisories/42758Third Party Advisory
• http://sota.gen.nz/compat2/Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.logBroken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:198Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:247Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/09/16/1Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/09/16/3Mailing List, Patch, Third Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0842.htmlThird Party Advisory
• http://www.ubuntu.com/usn/USN-1041-1Third Party Advisory
• http://www.vupen.com/english/advisories/2010/3117Third Party Advisory
• http://www.vupen.com/english/advisories/2011/0070Third Party Advisory
• http://www.vupen.com/english/advisories/2011/0298Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=634449Exploit, Issue Tracking, Third Party Advisory

Published

Sep 22, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-3295Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2010-3296The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3…
• CVE-2010-3297The eql_g_master_cfg function in drivers/net/eql.c in the Li…
• CVE-2010-3298The hso_get_count function in drivers/net/usb/hso.c in the L…
• CVE-2010-3299The encrypt/decrypt functions in Ruby on Rails 2.3 are vulne…6.5
• CVE-2010-3300It was found that all OWASP ESAPI for Java up to version 2.0…5.9
• CVE-2010-3302Buffer overflow in programs/pluto/xauth.c in the client in O…
• CVE-2010-3303Multiple cross-site scripting (XSS) vulnerabilities in Manti…
• CVE-2010-3304The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INB…
• CVE-2010-3305Cross-site request forgery (CSRF) vulnerability in pixelpost…8.8
• CVE-2010-3306Directory traversal vulnerability in the modURL function in …
• CVE-2010-3307Multiple PHP remote file inclusion vulnerabilities in themes…