Bug 622230 (CVE-2017-1000364, CVE-2017-1000365, CVE-2017-1000370, CVE-2017-1000371, CVE-2017-1000379) – kernel: stack clash

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description GLSAMaker/CVETool Bot 2017-06-19 15:30:25 UTC]

CVE-2017-1000364 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000364):
  An issue was discovered in the size of the stack guard page on Linux,
  specifically a 4k stack guard page is not sufficiently large and can be
  jmp’ed over, this affects Linux Kernel versions 4.11.5 and earlier (the
  stackguard page was introduced in 2010).

CVE-2017-1000365 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000365):
  The Linux Kernel imposes a size restriction on the arguments and
  environmental strings passed through RLIMIT_STACK/RLIMIT_INFINITY (1/4 of
  the size), but does not take the argument and environment pointers into
  account, which allows attackers to bypass this limitation. This affects
  Linux Kernel versions 4.11.5 and earlier.

CVE-2017-1000370 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000370):
  The offset2lib patch as used in the Linux Kernel contains a vulnerability
  that allows a PIE binary to be execve()'ed with 1GB of arguments or
  environmental strings then the stack occupies the address 0x80000000 and the
  PIE binary is mapped above 0x40000000 nullifying the protection of the
  offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This
  is a different issue than  CVE-2017-1000371.

CVE-2017-1000371 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000371):
  The offset2lib patch as used by the Linux Kernel contains a vulnerability,
  if RLIMIT_STACK is set to RLIMIT_INFINITY and 1 Gigabyte of memory is
  allocated (the maximum under the 1/4 restriction) then the stack will be
  grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000
  the minimum distance between the end of the PIE binary's read-write segment
  and the start of the stack becomes small enough that the stack guard page
  can be jumped over by an attacker. This affects Linux Kernel version 4.11.5.
  This is a different issue than CVE-2017-1000370 and CVE-2017-1000365.

CVE-2017-1000379 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000379):
  The Linux Kernel running on AMD64 systems will sometimes map the contents of
  PIE executable, the heap or ld.so to where the stack is mapped allowing
  attackers to more easily manipulate the stack. Linux Kernel version 4.11.5
  is affected.

[Comment 1 Thomas Deutschmann (RETIRED) 2017-06-19 15:33:55 UTC]

Say hello to "The Stack Clash"

[Comment 2 Ben 2017-06-24 11:14:25 UTC]

We had a bit of discussion on forums.gentoo.org for CVE 364.
Just wanted to add this in case someone was searching this without checking fgo.

https://forums.gentoo.org/viewtopic-t-1065154-highlight-.html

Hu found the commit that expanded the guard area, and I'm testing it backported into gentoo-sources-4.9.16 - however, without the actual exploit I cannot test its effectiveness other than it not causing side effects to normal operation.

Wanted to also clarify despite the guard page added in 2010, this was not the introduction of this bug (it's been around since virtually the dawn of Linux), rather an incomplete fix was made then.  The fix that was committed to 4.12pre6 which Hu found is also not a guaranteed fix, however it is thought that the vast majority of existing suid/sgid programs would be unusual to allocate stack space over 1MB in one function call, and thus should be sufficient to prevent privilege escalation.

[Comment 3 Tomáš Mózes 2017-06-27 07:48:50 UTC]

Fixed kernels released.

[Comment 4 John Helmert III 2022-03-26 00:03:18 UTC]

Fixes in 4.9.35, 4.13 onwards