CVE-2017-1000253 · netVigilance record NV24-0111

Linux Kernel PIE Stack Buffer Corruption

past due ransomware

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA deadline 2024-09-30 · passed 1 year 11 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

What happened

Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.

Who is affected

Linux Kernel. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Weakness class: CWE-119.

Timeline

2024-09-09
Added to CISA KEVExploitation in the wild confirmed by CISA
2024-09-30
CISA remediation deadlinepassed 1 year 11 months ago

Sources

NVD entry for CVE-2017-1000253 nvd.nist.gov/vuln/detail/CVE-2017-1000253
CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
git.kernel.org git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a87938b2e246b81b4fb713edb371a9fa3c5c3c86
nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2017-1000253