Bug 1462158 (CVE-2017-1000371)

Summary:	CVE-2017-1000371 kernel: offset2lib allows for the stack guard page to be jumped over
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aquini, bhu, blc, dhoward, fhrbata, gansalmon, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jch, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, lgoncalv, madhu.chinakonda, matt, mchehab, mcressma, mlangsdo, nmurray, pholasek, plougher, pmatouse, rt-maint, rvrbovsk, security-response-team, slawomir, williams, wmealing, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Linux kernel's implementation of mapping ELF PIE binary loading to allow evasion of the stack-guard page protection mechanisms that intend to mitigate this behavior. This issue appears to be limited to i386 based systems.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-04-22 10:31:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1462829, 1485758, 1485759, 1485760, 1485761
Bug Blocks:	1473655

Description Andrej Nemec 2017-06-16 10:42:55 UTC

The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.


Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eab09532d40090698b05a07c1c87f39fdbc5fab5

Comment 1 Andrej Nemec 2017-06-16 10:43:07 UTC

Acknowledgments:

Name: Qualys Inc

Comment 2 Andrej Nemec 2017-06-16 10:44:00 UTC

External References:

https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

Comment 3 Petr Matousek 2017-06-19 16:08:31 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1462829]

Comment 5 Wade Mealing 2017-08-28 03:05:41 UTC

Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 7, MRG-2 and realtime kernels.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6.
Future Linux kernel updates for the respective releases may address this issue.

Comment 11 errata-xmlrpc 2020-04-22 07:35:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2020:1524 https://access.redhat.com/errata/RHSA-2020:1524

Comment 12 Product Security DevOps Team 2020-04-22 10:31:46 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-1000371