CVE-2017-1000253 Linux Kernel PIE Stack Buffer Corruption Vulnerability
Active exploitation observed
· CISA KEV catalogueDescription
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| n/a | Versions not published | |
| centos | 7.1611 | No fix stated |
| enterprise_linux | 7.3 | No fix stated |
| enterprise_linux | 7.2 | No fix stated |
| enterprise_linux | 7.1 | No fix stated |
| enterprise_linux | 7.0 | No fix stated |
| enterprise_linux | 6.9 | No fix stated |
| enterprise_linux | 6.8 | No fix stated |
| enterprise_linux | 6.7 | No fix stated |
Show the 16 other branches Hide the 16 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| enterprise_linux | 6.6 | No fix stated |
| enterprise_linux | 6.5 | No fix stated |
| enterprise_linux | 6.4 | No fix stated |
| enterprise_linux | 6.3 | No fix stated |
| enterprise_linux | 6.2 | No fix stated |
| enterprise_linux | 6.1 | No fix stated |
| enterprise_linux | 6.0 | No fix stated |
| linux_kernel 3.19 | 3.19 → < 3.19.7 | 3.19.7 |
| linux_kernel 3.17 | 3.17 → < 3.18.14 | 3.18.14 |
| linux_kernel 3.15 | 3.15 → < 3.16.35 | 3.16.35 |
| linux_kernel 3.13 | 3.13 → < 3.14.41 | 3.14.41 |
| linux_kernel 3.11 | 3.11 → < 3.12.43 | 3.12.43 |
| linux_kernel 3.5 | 3.5 → < 3.10.77 | 3.10.77 |
| linux_kernel 3.3 | 3.3 → < 3.4.109 | 3.4.109 |
| linux_kernel 2.6 | 2.6.25 → < 3.2.70 | 3.2.70 |
| linux_kernel 1.0 | 1.0 → < 4.0.2 | 4.0.2 |
References
- RHSA-2017:2798 access.redhat.com
- RHSA-2017:2795 access.redhat.com
- 1039434 www.securitytracker.com
- RHSA-2017:2801 access.redhat.com
- RHSA-2017:2796 access.redhat.com
- 101010 www.securityfocus.com
- RHSA-2017:2799 access.redhat.com
- RHSA-2017:2794 access.redhat.com
- RHSA-2017:2793 access.redhat.com
- RHSA-2017:2797 access.redhat.com
- RHSA-2017:2802 access.redhat.com
- www.qualys.com www.qualys.com
- RHSA-2017:2800 access.redhat.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified