ZeroDay Findings
Sign inSign up

Findings

CVE-2017-1000253

Linux Kernel PIE Stack Buffer Corruption Vulnerability

Published Oct 4, 2017 · updated Jun 16, 2026 · centos centos

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 4, 2017 · Catalog

    Detected

    Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZ

  2. Sep 9, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Sep 30, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZ

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Sep 30, 2024

Affected

  • cpe centos/centos6.0
  • cpe centos/centos6.1
  • cpe centos/centos6.2
  • cpe centos/centos6.3
  • cpe centos/centos6.4
  • cpe centos/centos6.5
  • cpe centos/centos6.6
  • cpe centos/centos6.7
  • cpe linux/linux kernelversion unspecified
  • vendor Linux Kernelversion unspecified

Sources

  • CISA KEVCVE-2017-1000253

    Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.

    cisa.gov
  • CVE.orgCVE-2017-1000253

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-1000253

    30-day exploitation probability 10.7%

    first.org
  • Exploit Database42887

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2017-1000253

    Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backpo

    nvd.nist.gov

References

CVE-2017-1000253 · ZeroDay Findings