CVE-2007-4567: linux linux_kernel Improper Input Validation

Modified

Published 21-12-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-4567 is a high (CVSS 7.8) Improper Input Validation vulnerability in linux linux_kernel. EPSS estimates a 14.34% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (exploit-database, 19-12-2007)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v2.0 (NVD)

EPSS score

14.34%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 4

RHSA-2010:0019 RHSA-2010:0053 RHSA-2010:0079 RHSA-2010:0095

Timeline

21-12-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.22 does not properly validate the hop-by-hop IPv6 extended header, which allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted IPv6 packet.

CVSS metrics

1 score · 1 source · 1 version

v2.07.8

EPSS trend

Probability

14.34%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 14.34% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databasedoslinuxVerified
Linux Kernel 2.6.22 - IPv6 Hop-By-Hop Header Remote Denial of Service
Maturity: poc

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Linux1 product

linux_kernel≤ 2.6.21.7 | 2.2.27 | 2.4.36 | 2.4.36.1 | 2.4.36.2 | 2.4.36.3 | 2.4.36.4 | 2.4.36.5 | 2.4.36.6 | 2.6 | 2.6.18 | 2.6.18:rc1 | 2.6.18:rc2 | 2.6.18:rc3 | 2.6.18:rc4 | 2.6.18:rc5 | 2.6.18:rc6 | 2.6.18:rc7 | 2.6.19.4 | 2.6.19.5 | 2.6.19.6 | 2.6.19.7 | 2.6.20.16 | 2.6.20.17 | 2.6.20.18 | 2.6.20.19 | 2.6.20.20 | 2.6.20.21 | 2.6.21.5 | 2.6.21.6

1 vendor · 1 product

References

16 links

exchange.xforce.ibmcloud.com/vulnerabilities/39171VDB EntryX Refsource XF
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7474VDB EntrySignatureX Refsource OVAL
bugzilla.kernel.org/show_bug.cgi?id=8450X Refsource CONFIRM
secunia.com/advisories/28706Third Party AdvisoryX Refsource SECUNIAVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=548641X Refsource CONFIRM
www.redhat.com/support/errata/RHSA-2010-0053.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2010-0019.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/bid/26943VDB EntryX Refsource BID
usn.ubuntu.com/558-1/Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/25505Third Party AdvisoryX Refsource SECUNIAVendor Advisory

Show all 16 references

www.ubuntu.com/usn/usn-574-1Vendor AdvisoryX Refsource UBUNTU
rhn.redhat.com/errata/RHSA-2010-0095.htmlVendor AdvisoryX Refsource REDHAT
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11083VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/28170Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/38015Third Party AdvisoryX Refsource SECUNIAVendor Advisory
git.kernel.orgX Refsource CONFIRM