CoreCVE
Back

HIGH KEV Used in ransomware campaigns

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

Published Oct 4, 2017 ·Due Sep 30, 2024

Description

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

Affected products

Remediation

Red Hat statement

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6. This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 prior to kernel version 3.10.0-693, that is Red Hat Enterprise Linux 7.4 GA kernel version. Kernel versions after 3.10.0-693 contain the fix and are thus not vulnerable. This issue affects the Linux kernel-rt packages prior to the kernel version 3.10.0-693.rt56.617 (Red Hat Enteprise Linux for Realtime) and 3.10.0-693.2.1.rt56.585.el6rt (Red Hat Enterprise MRG 2). The latest Linux kernel-rt packages as shipped with Red Hat Enterprise Linux for Realtime and Red Hat Enterprise MRG 2 are not vulnerable. Future Linux kernel updates for the respective releases will address this issue.

Red Hat mitigation

By setting vm.legacy_va_layout to 1 we can effectively disable the exploitation of this issue by switching to the legacy mmap layout. The mmap allocations start much lower in the process address space and follow the bottom-up allocation model. As such, the initial PIE executable mapping is far from the reserved stack area and cannot interfere with the stack. 64-bit processes on Red Hat Enterprise Linux 5 are forced to use the legacy virtual address space layout regardless of the vm.legacy_va_layout value. Note: Applications that have demands for a large linear address space (such as certain databases) may be unable to handle the legacy memory layout proposed using this mitigation. We recommend to test your systems and applications before deploying this mitigation on production systems. Edit the /etc/sysctl.conf file as root, and add or amend: vm.legacy_va_layout = 1 To apply this setting, run the /sbin/sysctl -p command as the root user to reload the settings from /etc/sysctl.conf. Verify that vm.legacy_va_layout is now set to defined value: $ /sbin/sysctl vm.legacy_va_layout vm.legacy_va_layout = 1

Metrics

Weaknesses (1)

CWE-119

Buffer Overflow

References (19)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 4, 2017
Updated Oct 21, 2025
Reserved Oct 3, 2017
Link CVE-2017-1000253
CISA Vulnrichment
Updated Sep 10, 2024
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2017-1000253
Red Hat
Severity Important
Public date Sep 26, 2017
Links CVE-2017-1000253 - Bugzilla