CVE-2017-1000371: Input Validation
A flaw was found in the Linux kernel's implementation of mapping ELF PIE binary loading to allow evasion of the stack-guard page protection mechanisms that intend to mitigate this behavior. This issue appears to be limited to i386 based systems.
Other sources
The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMITSTACK is set to RLIMINFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-754.29.1.el6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch eab09532d40090698b05a07c1c87f39fdbc5fab5
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000371?
CVE-2017-1000371 is rated as high severity due to its potential to cause a denial of service through memory exhaustion.
How do I fix CVE-2017-1000371?
To fix CVE-2017-1000371, ensure your kernel is updated to one of the recommended versions listed by your distribution.
What are the affected versions of the kernel for CVE-2017-1000371?
Affected versions for CVE-2017-1000371 include various releases of the Linux kernel between versions 4.1 to 4.12.
What systems are vulnerable to CVE-2017-1000371?
Systems running affected versions of the Linux kernel, particularly those with the offset2lib patch activated, are vulnerable to CVE-2017-1000371.
Is CVE-2017-1000371 remote exploitable?
CVE-2017-1000371 is typically not remote exploitable as it requires local access to the system to trigger the vulnerability.