CVE-2017-1000253

CVE-2017-1000253 is a memory-corruption flaw (CWE-119) in the Linux kernel's ELF binary loader: when CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE is enabled with a top-down allocation strategy, load_elf_binary() maps a PIE (position-independent executable) immediately below mm->mmap_base without reserving space for the entire binary, so subsequent PT_LOAD segments are mapped above mmap_base into the gap reserved between the stack and the binary. Any local user can trigger the flaw simply by executing a PIE binary on an affected unpatched long-term kernel. The resulting corruption of the stack region yields local privilege escalation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, local attack vector, low privileges required). Affected systems are Linux distributions running long-term kernels that lack the April 2015 fix commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 — notably Red Hat Enterprise Linux and CentOS kernels — where the fix was applied but not recognized as a security issue at the time. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2024-09-09 with known ransomware use, and EPSS assigns a 10.7% probability of exploitation within 30 days (96th percentile); no public PoC is known.

What to do: Update affected systems to kernel packages that include commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (upstream since April 2015 and backported to Linux 3.10.77), or move to a currently supported kernel branch; per CISA KEV, apply vendor mitigations or discontinue use of the product if mitigations are unavailable. Prioritize legacy RHEL/CentOS and other long-lived LTS deployments — especially internet-facing or ransomware-targeted servers — and check whether running kernels are built with CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE and allow unprivileged users to execute PIE binaries.