#VU38830 Input validation error in Linux kernel - CVE-2017-1000379
Vulnerability identifier: #VU38830
Vulnerability risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local authenticated user to execute arbitrary code.
The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: 4.11.5
External links
https://www.securityfocus.com/bid/99284
https://access.redhat.com/errata/RHSA-2017:1482
https://access.redhat.com/errata/RHSA-2017:1484
https://access.redhat.com/errata/RHSA-2017:1485
https://access.redhat.com/errata/RHSA-2017:1486
https://access.redhat.com/errata/RHSA-2017:1487
https://access.redhat.com/errata/RHSA-2017:1488
https://access.redhat.com/errata/RHSA-2017:1489
https://access.redhat.com/errata/RHSA-2017:1490
https://access.redhat.com/errata/RHSA-2017:1491
https://access.redhat.com/errata/RHSA-2017:1616
https://access.redhat.com/errata/RHSA-2017:1647
https://access.redhat.com/errata/RHSA-2017:1712
https://access.redhat.com/errata/RHSA-2017:1842
https://access.redhat.com/security/cve/CVE-2017-1000379
https://www.exploit-db.com/exploits/42275/
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
