| Vulnerability Name: | CVE-2017-1000371 (CCN-127456) | ||||||||||||||||||||||||
| Assigned: | 2017-06-19 | ||||||||||||||||||||||||
| Published: | 2017-06-19 | ||||||||||||||||||||||||
| Updated: | 2023-01-17 | ||||||||||||||||||||||||
| Summary: | The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems. | ||||||||||||||||||||||||
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) 7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C)
3.7 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:U/RC:C)
2.7 Low (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:U/RC:C)
| ||||||||||||||||||||||||
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
| ||||||||||||||||||||||||
| Vulnerability Type: | CWE-20 | ||||||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-1000371 Source: cve@mitre.org Type: Third Party Advisory cve@mitre.org Source: CCN Type: BID-99131 Linux Kernel CVE-2017-1000371 Local Security Bypass Vulnerability Source: cve@mitre.org Type: Third Party Advisory, VDB Entry cve@mitre.org Source: cve@mitre.org Type: Third Party Advisory, VDB Entry cve@mitre.org Source: CCN Type: Red Hat Bugzilla Bug 1462158 (CVE-2017-1000371) CVE-2017-1000371 kernel: offset2lib allows for the stack guard page to be jumped over Source: XF Type: UNKNOWN linux-kernel-cve20171000371-sec-bypass(127456) Source: cve@mitre.org Type: Third Party Advisory, VDB Entry cve@mitre.org Source: cve@mitre.org Type: Third Party Advisory, VDB Entry cve@mitre.org Source: CCN Type: IBM Security Bulletin 6241524 (Security QRadar Packet Capture) IBM Security QRadar Packet Capture is vulnerable to Using Components with Known Vulnerabilities Source: CCN Type: Qualys Security Advisory QSA - 2017-06-19 The Stack Clash Source: cve@mitre.org Type: Third Party Advisory cve@mitre.org Source: CCN Type: WhiteSource Vulnerability Database CVE-2017-1000371 | ||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration RedHat 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||
| |||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||