NVD Vulnerability Detail

CVE-2017-1000371

Summary	The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.
Publication Date	June 20, 2017, 1:29 a.m.
Registration Date	Jan. 26, 2021, 1:11 p.m.
Last Update	Nov. 21, 2024, 12:04 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.debian.org/security/2017/dsa-3981	Third Party Advisory
2	http://www.debian.org/security/2017/dsa-3981	Third Party Advisory
3	http://www.securityfocus.com/bid/99131	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/99131	Third Party Advisory VDB Entry
5	https://access.redhat.com/security/cve/CVE-2017-1000371	Third Party Advisory VDB Entry
6	https://access.redhat.com/security/cve/CVE-2017-1000371	Third Party Advisory VDB Entry
7	https://www.exploit-db.com/exploits/42273/	Third Party Advisory VDB Entry
8	https://www.exploit-db.com/exploits/42273/	Third Party Advisory VDB Entry
9	https://www.exploit-db.com/exploits/42276/	Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/42276/	Third Party Advisory VDB Entry
11	https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt	Third Party Advisory
12	https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Linux Kernel で使用される offset2lib パッチにおける認可・権限・アクセス制御に関する脆弱性

Title	Linux Kernel で使用される offset2lib パッチにおける認可・権限・アクセス制御に関する脆弱性
Summary	Linux Kernel で使用される offset2lib パッチには、認可・権限・アクセス制御に関する脆弱性が存在します。本脆弱性は、CVE-2017-1000370 および CVE-2017-1000365 とは異なる脆弱性です。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	June 19, 2017, midnight
Registration Date	July 11, 2017, 4:35 p.m.
Last Update	July 11, 2017, 4:35 p.m.

Affected System

Linux

Linux Kernel 4.11.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-1000371	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000371
National Vulnerability Database (NVD)
2	CVE-2017-1000371	https://nvd.nist.gov/vuln/detail/CVE-2017-1000371
Red Hat CVE Database
3	CVE-2017-1000371	https://access.redhat.com/security/cve/CVE-2017-1000371

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Linux Kernel
1	Linux Kernel Archives	http://www.kernel.org

Change Log

No	Changed Details	Date of change
0	[2017年07月11日] 掲載	Feb. 17, 2018, 10:37 a.m.