Strix
26.1K

CVE-2017-1000253

HIGHCVSS 7.8/10Actively ExploitedEPSS 10.70%

Last modified

CVE-2017-1000253 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. CISA has confirmed active exploitation in the wild. EPSS estimates a 10.70% chance of exploitation in the next 30 days.

Description

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
10.70%

95.2th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .

Weakness Enumeration

Affected Software

VendorProductVersions
CentosCentos6.0
CentosCentos6.1
CentosCentos6.2
CentosCentos6.3
CentosCentos6.4
CentosCentos6.5
CentosCentos6.6
CentosCentos6.7
CentosCentos6.8
CentosCentos6.9
CentosCentos7.1406
CentosCentos7.1503
CentosCentos7.1511
CentosCentos7.1611
RedhatEnterprise Linux6.0
RedhatEnterprise Linux6.1
RedhatEnterprise Linux6.2
RedhatEnterprise Linux6.3
RedhatEnterprise Linux6.4
RedhatEnterprise Linux6.5
RedhatEnterprise Linux6.6
RedhatEnterprise Linux6.7
RedhatEnterprise Linux6.8
RedhatEnterprise Linux6.9
RedhatEnterprise Linux7.0
RedhatEnterprise Linux7.1
RedhatEnterprise Linux7.2
RedhatEnterprise Linux7.3
LinuxLinux Kernel>= 2.6.25, < 3.2.70
LinuxLinux Kernel>= 3.3, < 3.4.109
LinuxLinux Kernel>= 3.5, < 3.10.77
LinuxLinux Kernel>= 3.11, < 3.12.43
LinuxLinux Kernel>= 3.13, < 3.14.41
LinuxLinux Kernel>= 3.15, < 3.16.35
LinuxLinux Kernel>= 3.17, < 3.18.14
LinuxLinux Kernel>= 3.19, < 3.19.7
LinuxLinux Kernel>= 4.0, < 4.0.2

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2017-1000253?
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
How severe is CVE-2017-1000253?
CVE-2017-1000253 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 10.70% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2017-1000253?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-1000253?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST