An issue was discovered in the size of the stack guard page on Linux,
specifically a 4k stack guard page is not sufficiently large and can be
jmp’ed over, this affects Linux Kernel versions 4.11.5 and earlier (the
stackguard page was introduced in 2010).
The Linux Kernel imposes a size restriction on the arguments and
environmental strings passed through RLIMIT_STACK/RLIMIT_INFINITY (1/4 of
the size), but does not take the argument and environment pointers into
account, which allows attackers to bypass this limitation. This affects
Linux Kernel versions 4.11.5 and earlier.
The offset2lib patch as used in the Linux Kernel contains a vulnerability
that allows a PIE binary to be execve()'ed with 1GB of arguments or
environmental strings then the stack occupies the address 0x80000000 and the
PIE binary is mapped above 0x40000000 nullifying the protection of the
offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This
is a different issue than CVE-2017-1000371.
The offset2lib patch as used by the Linux Kernel contains a vulnerability,
if RLIMIT_STACK is set to RLIMIT_INFINITY and 1 Gigabyte of memory is
allocated (the maximum under the 1/4 restriction) then the stack will be
grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000
the minimum distance between the end of the PIE binary's read-write segment
and the start of the stack becomes small enough that the stack guard page
can be jumped over by an attacker. This affects Linux Kernel version 4.11.5.
This is a different issue than CVE-2017-1000370 and CVE-2017-1000365.
The Linux Kernel running on AMD64 systems will sometimes map the contents of
PIE executable, the heap or ld.so to where the stack is mapped allowing
attackers to more easily manipulate the stack. Linux Kernel version 4.11.5
Say hello to "The Stack Clash"
We had a bit of discussion on forums.gentoo.org for CVE 364.
Just wanted to add this in case someone was searching this without checking fgo.
Hu found the commit that expanded the guard area, and I'm testing it backported into gentoo-sources-4.9.16 - however, without the actual exploit I cannot test its effectiveness other than it not causing side effects to normal operation.
Wanted to also clarify despite the guard page added in 2010, this was not the introduction of this bug (it's been around since virtually the dawn of Linux), rather an incomplete fix was made then. The fix that was committed to 4.12pre6 which Hu found is also not a guaranteed fix, however it is thought that the vast majority of existing suid/sgid programs would be unusual to allocate stack space over 1MB in one function call, and thus should be sufficient to prevent privilege escalation.
Fixed kernels released.