PT-2017-2282 · Linux+3 · Linux Kernel+3
Publicado
2017-06-18
·
Atualizado
2023-01-17
·
CVE-2017-1000365
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux Kernel versions prior to 4.11.5
Linux Kernel versions 2.6.23 through 4.11.5
Description
The issue is related to the implementation of the Stack Guard-Page mechanism in the Linux Kernel, which does not properly check the values of arguments and pointers against RLIMIT STACK/RLIM INFINITY. This can be exploited by a local attacker to cause a denial of service, potentially leading to memory damage. The Linux Kernel has a size restriction on arguments and environmental strings passed through RLIMIT STACK/RLIM INFINITY, but it does not account for the argument and environment pointers, allowing attackers to bypass this limitation.
Recommendations
For Linux Kernel versions prior to 4.11.5, update to a version later than 4.11.5 to resolve the issue.
For Linux Kernel versions 2.6.23 through 4.11.5, consider restricting access to the
RLIMIT STACK and RLIM INFINITY values to minimize the risk of exploitation until a patch is available.Exploit
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Linux Kernel
Suse
Ubuntu