CVE-2017-1000253: Linux Kernel PIE Stack Buffer Corruption Vulnerability
A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system.
Upstream patch:
https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86
Other sources
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIGARCHBINFMTELFRANDOMIZEPIE enabled, and a normal top-down address allocation strategy, loadelfbinary() will attempt to map a PIE binary into an address range immediately below mm->mmapbase. Unfortunately, loadelf binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PTLOAD segment is mapped below mm->mmapbase, the subsequent PTLOAD segment(s) end up being mapped above mm->mmapbase into the are that is supposed to be the "gap" between the stack and the binary.
— NVD
Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in loadelf binary() that allows a local attacker to escalate privileges.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch a87938b2e246b81b4fb713edb371a9fa3c5c3c86 - Upgrade
Upgrade
Red Hat Kernel-develto a version that resolves this vulnerability.Fixed in 3.10.77 - Configuration
Build/install a kernel with CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE disabled (set to 'n') to prevent PIE binaries being mapped into the stack gap.
Linux kernel (build configuration) CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000253?
CVE-2017-1000253 is classified as a high-severity vulnerability due to the potential for local privilege escalation.
How do I fix CVE-2017-1000253?
To fix CVE-2017-1000253, apply the latest kernel updates provided by your Linux distribution.
What systems are affected by CVE-2017-1000253?
CVE-2017-1000253 affects various versions of the Linux kernel, particularly those in CentOS 6.x and 7.x, as well as Red Hat Enterprise Linux 6.x and 7.x.
Can CVE-2017-1000253 be exploited remotely?
CVE-2017-1000253 requires local access to the system for exploitation, meaning it is not a remote vulnerability.
What is the impact of CVE-2017-1000253 on my applications?
CVE-2017-1000253 can allow attackers to gain elevated privileges, potentially compromising sensitive applications running on affected systems.