Bug 1462147 (CVE-2017-1000365)
Summary: | CVE-2017-1000365 kernel: RLIMIT_STACK/RLIMIT_INFINITY string size limitation bypass | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | apmukher, aquini, bhu, blc, dhoward, fhrbata, gansalmon, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, lgoncalv, madhu.chinakonda, mchehab, mcressma, mlangsdo, nmurray, pholasek, pmatouse, ravpatil, rt-maint, rvrbovsk, sbalasub, security-response-team, slawomir, vdronov, williams, wmealing |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: |
The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIMIT_INFINITY, but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-10-27 10:53:00 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1462827 | ||
Bug Blocks: | 1473651 |
Description
Andrej Nemec
2017-06-16 10:31:25 UTC
Acknowledgments: Name: Qualys Inc. External References: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1462827] Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5,6, 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue. Hello Any ETA for errata for this vulnerability. RHEL 5,6,7 are affected by this bug. No errata has been released, any possible ETA would help to pass on information to customer. Looking back through my mail, I had lodged a dispute with mitre about this being an actual flaw, it was turned down EL7 was fixed in commit 2ddf8223ea49e280967762dc2d954aea2d497c80 Which was fixed in kernel-3.10.0-1000.el7 or newer. This low wouldn't qualify for a fix in el5 and 6. at this point (or then) either. |