Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-1000371: Linux Kernel 4.11.5 allows stack bypass on 32-bit systems

CVE-2017-1000371 · published 9 years ago

Summary

The Linux kernel version 4.11.5 on 32-bit i386 machines can let an attacker skip the safety page that protects the stack when the stack size is set to unlimited and a large block of memory is allocated. This creates a chance for code execution that could compromise the system. Upgrade to a newer kernel version or revert the stack limit setting to a finite value until a patch is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
linux	linux_kernel	>= 4.1, < 4.1.43 >= 4.2, < 4.4.78 >= 4.5, < 4.9.39 >= 4.10, < 4.11.12 >= 4.12, < 4.12.3 `cpe:2.3:o:linux:linux_kernel::::::::`

Original advisory text

The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.

References

http://www.debian.org/security/2017/dsa-3981 Third Party Advisory
http://www.securityfocus.com/bid/99131 Third Party Advisory VDB Entry
https://access.redhat.com/security/cve/CVE-2017-1000371 Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/42273/ Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/42276/ Third Party Advisory VDB Entry
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

3% chance of attack within 30 days

Timeline

Published19 Jun 2017

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-1000371 · NVD

Track software like this

Free during beta