2-Year-Old Linux Kernel Issue Resurfaces As High
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-1000253 | Linux Kernel PIE Stack Buffer Corruption Enables Local Privilege Escalation CVE-2017-1000253 is a memory-corruption flaw (CWE-119) in the Linux kernel's ELF binary loader: when CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE is enabled with a top-down allocation strategy, load_elf_binary() maps a PIE (position-independent executable) immediately below mm->mmap_base without reserving space for the entire binary, so subsequent PT_LOAD segments are mapped above mmap_base into the gap reserved between the stack and the binary. Any local user can trigger the flaw simply by executing a PIE binary on an affected unpatched long-term kernel. The resulting corruption of the stack region yields local privilege escalation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, local attack vector, low privileges required). Affected systems are Linux distributions running long-term kernels that lack the April 2015 fix commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 — notably Red Hat Enterprise Linux and CentOS kernels — where the fix was applied but not recognized as a security issue at the time. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2024-09-09 with known ransomware use, and EPSS assigns a 10.7% probability of exploitation within 30 days (96th percentile); no public PoC is known. Do: Update affected systems to kernel packages that include commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (upstream since April 2015 and backported to Linux 3.10.77), or move to a currently supported kernel branch; per CISA KEV, apply vendor mitigations or discontinue use of the product if mitigations are unavailable. Prioritize legacy RHEL/CentOS and other long-lived LTS deployments — especially internet-facing or ransomware-targeted servers — and check whether running kernels are built with CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE and allow unprivileged users to execute PIE binaries. | 7.8 | 11% | KEV ransomware |
| massmillions of servers and appliances on unpatched legacy LTS kernels (enterprise Linux installed base) |
Full article422 words · extracted from thehackernews.com · click to collapse
A bug in Linux kernel that was discovered two years ago, but was not considered a security threat at that time, has now been recognised as a potential local privilege escalation flaw.
Identified as CVE-2017-1000253, the bug was initially discovered by Google researcher Michael Davidson in April 2015.
Since it was not recognised as a serious bug at that time, the patch for this kernel flaw was not backported to long-term Linux distributions in kernel 3.10.77.
However, researchers at Qualys Research Labs has now found that this vulnerability could be exploited to escalate privileges and it affects all major Linux distributions, including Red Hat, Debian, and CentOS.
The vulnerability left "all versions of CentOS 7 before 1708 (released on September 13, 2017), all versions of Red Hat Enterprise Linux 7 before 7.4 (released on August 1, 2017), and all versions of CentOS 6 and Red Hat Enterprise Linux 6 are exploitable," Qualys said in an advisory published yesterday.
The vulnerability, which has been given a CVSS3 Base Score of 7.8 out of 10, resides in the way Linux kernel loads ELF executables, which potentially results in memory corruption.
Researchers find that an unprivileged local user with access to SUID (or otherwise privileged) Position Independent Executable (PIE) binary could use this vulnerability to escalate their privileges on the affected system.
In order to mitigate this issue, users can switch to the legacy mmap layout by setting vm.legacy_va_layout to 1, which will effectively disable the exploitation of this security flaw.
Since the mmap allocations start much lower in the process address space and follow the bottom-up allocation model, "the initial PIE executable mapping is far from the reserved stack area and cannot interfere with the stack."
Qualys says this flaw is not limited to the PIEs whose read-write segment is larger than 128MB, which is the minimum distance between the mmap_base and the highest address of the stack, not the lowest address of the stack.
So, when passing 1.5GB of argument strings to execve(), any PIE can be mapped directly below the stack and trigger the vulnerability.
Linux distributions, including Red Hat, Debian, and CentOS, have released security updates to address the vulnerability.
The Qualys team has promised to publish a proof-of-concept soon exploit that works on CentOS-7 kernel versions "3.10.0-514.21.2.el7.x86_64" and "3.10.0-514.26.1.el7.x86_64," once a maximum number of users have had time to patch their systems against the flaw.
Stay Tuned!
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2017/09/linux-kernel-hacking.html