CVE-2017-1000364 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000364): An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be jmp’ed over, this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010). CVE-2017-1000365 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000365): The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIMIT_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. CVE-2017-1000370 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000370): The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000 and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. CVE-2017-1000371 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000371): The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIMIT_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. CVE-2017-1000379 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000379): The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.
Say hello to "The Stack Clash"
We had a bit of discussion on forums.gentoo.org for CVE 364. Just wanted to add this in case someone was searching this without checking fgo. https://forums.gentoo.org/viewtopic-t-1065154-highlight-.html Hu found the commit that expanded the guard area, and I'm testing it backported into gentoo-sources-4.9.16 - however, without the actual exploit I cannot test its effectiveness other than it not causing side effects to normal operation. Wanted to also clarify despite the guard page added in 2010, this was not the introduction of this bug (it's been around since virtually the dawn of Linux), rather an incomplete fix was made then. The fix that was committed to 4.12pre6 which Hu found is also not a guaranteed fix, however it is thought that the vast majority of existing suid/sgid programs would be unusual to allocate stack space over 1MB in one function call, and thus should be sufficient to prevent privilege escalation.
Fixed kernels released.
Fixes in 4.9.35, 4.13 onwards
