CVE-2017-1000365: Input Validation
Last updated 29 November 2024
Other sources
The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMITSTACK/RLIMINFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was introduced in the Linux Kernel version 2.6.23.
The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMITSTACK/RLIMITINFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation.
This method in itself is not an exploit, but bypassing this mechanism is the flaw/issue being tracked.
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=98da7d08850fb8bdeb395d6368ed15753304aa0c
The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMITSTACK/RLIMITINFINITY, but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000365?
The severity of CVE-2017-1000365 is low.
Which versions of Linux Kernel are affected by CVE-2017-1000365?
Linux Kernel versions 3.13.0-126.175, 4.4.0-89.112, 4.10.0-30.34, and newer versions are affected by CVE-2017-1000365.
How does CVE-2017-1000365 bypass the size restriction?
CVE-2017-1000365 bypasses the size restriction by not taking the argument and environment pointers into account.
What is the Common Weakness Enumeration (CWE) ID of CVE-2017-1000365?
The CWE ID of CVE-2017-1000365 is CWE-20.
Where can I find more information about CVE-2017-1000365?
You can find more information about CVE-2017-1000365 at the following references: [link1], [link2], [link3].