Check Point Advisories

Linux Kernel x86-64 IA32SysCall Privilege Escalation (CVE-2010-3301)

Vulnerability
Protection

Check Point Reference:	CPAI-2016-0762
Date Published:	5 Sep 2016
Severity:	High
Last Updated:	Thursday 15 September, 2016
Source:
Industry Reference:	CVE-2010-3301
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?	Canonical Ubuntu Linux _Other Debian Project Debian GNU/Linux _Other Linux Kernel Project Linux Kernel 2.6.27-rc1 and later Red Hat Desktop Linux _OTHER_ Red Hat Enterprise Linux _Other
Vulnerability Description	An old vulnerability has been reintroduced in certain versions of the Linux Kernel that could be exploited by local unprivileged users to elevate their default system designated privileges to the higher kernel level privileges. The vulnerability is due to an error that kernel does not zero-extend x86_64 registers in the 32bit entry path on x86_64 platforms. An attacker could elevate their local privilege resulting in a privilege escalation.

Protection Overview

This protection detects attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Linux Kernel x86-64 IA32SysCall Privilege Escalation protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: ICMP Protocol Violation.
Attack Information: Linux Kernel x86-64 IA32SysCall Privilege Escalation