Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 632380 (CVE-2017-1000253) - kernel: PIE/stack corruption
Summary: kernel: PIE/stack corruption
Alias: CVE-2017-1000253
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Kernel Security
Depends on:
Reported: 2017-09-29 13:29 UTC by Thomas Deutschmann (RETIRED)
Modified: 2017-09-29 13:31 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann (RETIRED) gentoo-dev 2017-09-29 13:29:33 UTC
A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption. An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system.

Upstream patch:
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2017-09-29 13:31:52 UTC
No vulnerable sys-kernel/gentoo-sources left in tree, all done.