NVD Vulnerability Detail

CVE-2017-1000370

Summary	The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000 and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. This issue appears to be limited to i386 based systems.
Publication Date	June 20, 2017, 1:29 a.m.
Registration Date	Jan. 26, 2021, 1:11 p.m.
Last Update	Nov. 21, 2024, 12:04 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.debian.org/security/2017/dsa-3981	Third Party Advisory
2	http://www.debian.org/security/2017/dsa-3981	Third Party Advisory
3	http://www.securityfocus.com/bid/99149	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/99149	Third Party Advisory VDB Entry
5	https://access.redhat.com/security/cve/CVE-2017-1000370	Third Party Advisory VDB Entry
6	https://access.redhat.com/security/cve/CVE-2017-1000370	Third Party Advisory VDB Entry
7	https://www.exploit-db.com/exploits/42273/	Third Party Advisory VDB Entry
8	https://www.exploit-db.com/exploits/42273/	Third Party Advisory VDB Entry
9	https://www.exploit-db.com/exploits/42274/	Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/42274/	Third Party Advisory VDB Entry
11	https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt	Third Party Advisory
12	https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Linux Kernel で使用される offset2lib パッチにおける認可・権限・アクセス制御に関する脆弱性

Title	Linux Kernel で使用される offset2lib パッチにおける認可・権限・アクセス制御に関する脆弱性
Summary	Linux Kernel で使用される offset2lib パッチには、認可・権限・アクセス制御に関する脆弱性が存在します。本脆弱性は、CVE-2017-1000371 とは異なる脆弱性です。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	June 19, 2017, midnight
Registration Date	July 11, 2017, 4:35 p.m.
Last Update	July 11, 2017, 4:35 p.m.

Affected System

Linux

Linux Kernel 4.11.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-1000370	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000370
National Vulnerability Database (NVD)
2	CVE-2017-1000370	https://nvd.nist.gov/vuln/detail/CVE-2017-1000370
Red Hat CVE Database
3	CVE-2017-1000370	https://access.redhat.com/security/cve/CVE-2017-1000370

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Linux Kernel
1	Linux Kernel Archives	http://www.kernel.org

Change Log

No	Changed Details	Date of change
0	[2017年07月11日] 掲載	Feb. 17, 2018, 10:37 a.m.