PT-2017-2282 · Linux+3 · Linux Kernel+3
Published
2017-06-18
·
Updated
2023-01-17
·
CVE-2017-1000365
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux Kernel versions prior to 4.11.5
Linux Kernel versions 2.6.23 through 4.11.5
Description
The issue is related to the implementation of the Stack Guard-Page mechanism in the Linux Kernel, which does not properly check the values of arguments and pointers against RLIMIT STACK/RLIM INFINITY. This can be exploited by a local attacker to cause a denial of service, potentially leading to memory damage. The Linux Kernel has a size restriction on arguments and environmental strings passed through RLIMIT STACK/RLIM INFINITY, but it does not account for the argument and environment pointers, allowing attackers to bypass this limitation.
Recommendations
For Linux Kernel versions prior to 4.11.5, update to a version later than 4.11.5 to resolve the issue.
For Linux Kernel versions 2.6.23 through 4.11.5, consider restricting access to the
RLIMIT STACK and RLIM INFINITY values to minimize the risk of exploitation until a patch is available.Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Linux Kernel
Suse
Ubuntu