Bug 1461333 (CVE-2017-1000364) - CVE-2017-1000364 kernel: heap/stack gap jumping via unbounded stack allocations
Summary: CVE-2017-1000364 kernel: heap/stack gap jumping via unbounded stack allocations
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-1000364
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Engineering1452722 Engineering1452723 Engineering1452724 Engineering1452725 Engineering1452726 Engineering1452727 Engineering1452728 Engineering1452729 Engineering1452730 Engineering1452731 Engineering1452732 Engineering1452733 Red Hat1455397 Red Hat1458802 Engineering1461495 Engineering1461496 Engineering1461497 Engineering1461915 Engineering1462320 Engineering1462321 Engineering1462354 Engineering1462355 1462819 1463241 Engineering1463823 Engineering1464260
Blocks: Embargoed1449010
TreeView+ depends on / blocked
 
Reported: 2017-06-14 08:54 UTC by Petr Matousek
Modified: 2021-02-05 19:09 UTC (History)
56 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue more difficult.
Clone Of:
Environment:
Last Closed: 2017-06-29 16:44:27 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1482 0 normal SHIPPED_LIVE Important: kernel security update 2017-06-19 22:38:54 UTC
Red Hat Product Errata RHSA-2017:1483 0 normal SHIPPED_LIVE Important: kernel security update 2017-06-19 23:13:54 UTC
Red Hat Product Errata RHSA-2017:1484 0 normal SHIPPED_LIVE Important: kernel security update 2017-06-20 04:14:33 UTC
Red Hat Product Errata RHSA-2017:1485 0 normal SHIPPED_LIVE Important: kernel security update 2017-06-19 22:39:11 UTC
Red Hat Product Errata RHSA-2017:1486 0 normal SHIPPED_LIVE Important: kernel security update 2017-06-19 21:57:39 UTC
Red Hat Product Errata RHSA-2017:1487 0 normal SHIPPED_LIVE Important: kernel security update 2017-06-19 21:17:21 UTC
Red Hat Product Errata RHSA-2017:1488 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-06-19 22:49:25 UTC
Red Hat Product Errata RHSA-2017:1489 0 normal SHIPPED_LIVE Important: kernel security update 2017-06-19 19:46:20 UTC
Red Hat Product Errata RHSA-2017:1490 0 normal SHIPPED_LIVE Important: kernel security update 2017-06-19 21:43:38 UTC
Red Hat Product Errata RHSA-2017:1491 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-06-19 22:59:33 UTC
Red Hat Product Errata RHSA-2017:1567 0 normal SHIPPED_LIVE Important: Red Hat Container Development Kit 3.0.0 security update 2017-06-21 19:11:05 UTC
Red Hat Product Errata RHSA-2017:1616 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-06-28 20:57:58 UTC
Red Hat Product Errata RHSA-2017:1647 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-06-28 20:34:27 UTC

Description Petr Matousek 2017-06-14 08:54:40 UTC 
A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system.

This is a tracking bug for the kernel part of the mitigation.

Upstream kernel patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1be7107fbe18eed3e319a6c3e83c78254b693acb
Comment 1 Petr Matousek 2017-06-14 08:54:48 UTC 
Acknowledgments:

Name: Qualys Research Labs
Comment 11 Petr Matousek 2017-06-16 18:41:11 UTC 
External References:

https://access.redhat.com/security/vulnerabilities/stackguard
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
Comment 14 Petr Matousek 2017-06-19 15:45:52 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1462819]
Comment 15 errata-xmlrpc 2017-06-19 15:46:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.5 Advanced Update Support
  Red Hat Enterprise Linux 6.5 Telco Extended Update Support

Via RHSA-2017:1489 https://access.redhat.com/errata/RHSA-2017:1489
Comment 16 errata-xmlrpc 2017-06-19 17:18:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support

Via RHSA-2017:1487 https://access.redhat.com/errata/RHSA-2017:1487
Comment 17 errata-xmlrpc 2017-06-19 17:44:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.4 Advanced Update Support

Via RHSA-2017:1490 https://access.redhat.com/errata/RHSA-2017:1490
Comment 18 errata-xmlrpc 2017-06-19 17:58:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:1486 https://access.redhat.com/errata/RHSA-2017:1486
Comment 19 errata-xmlrpc 2017-06-19 18:39:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5 Extended Lifecycle Support

Via RHSA-2017:1482 https://access.redhat.com/errata/RHSA-2017:1482
Comment 20 errata-xmlrpc 2017-06-19 18:40:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Extended Update Support

Via RHSA-2017:1485 https://access.redhat.com/errata/RHSA-2017:1485
Comment 21 errata-xmlrpc 2017-06-19 18:51:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.6 Advanced Update Support
  Red Hat Enterprise Linux 6.6 Telco Extended Update Support

Via RHSA-2017:1488 https://access.redhat.com/errata/RHSA-2017:1488
Comment 22 errata-xmlrpc 2017-06-19 19:00:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.2 Advanced Update Support

Via RHSA-2017:1491 https://access.redhat.com/errata/RHSA-2017:1491
Comment 23 errata-xmlrpc 2017-06-19 19:14:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5.9 Long Life

Via RHSA-2017:1483 https://access.redhat.com/errata/RHSA-2017:1483
Comment 24 errata-xmlrpc 2017-06-20 00:15:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1484 https://access.redhat.com/errata/RHSA-2017:1484
Comment 25 errata-xmlrpc 2017-06-21 15:12:12 UTC 
This issue has been addressed in the following products:

  CDK 3.0

Via RHSA-2017:1567 https://access.redhat.com/errata/RHSA-2017:1567
Comment 26 customercare 2017-06-22 09:28:38 UTC 
24h test run under Fedora 24 result:

kernel-4.11.6-101.fc24.x86_64  *works*
Comment 27 Fedora Update System 2017-06-23 20:52:42 UTC 
kernel-4.11.6-201.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.
Comment 28 Fedora Update System 2017-06-24 03:06:35 UTC 
kernel-4.11.6-301.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.
Comment 29 David Howells 2017-06-26 12:54:56 UTC 
This fix causes Red Hatbug 1464237.
Comment 30 Chris Reed 2017-06-26 15:34:52 UTC 
This is almost certainly the cause of https://bugzilla.redhat.com/show_bug.cgi?id=1464185 as well.
Comment 32 errata-xmlrpc 2017-06-28 16:36:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2017:1647 https://access.redhat.com/errata/RHSA-2017:1647
Comment 33 errata-xmlrpc 2017-06-28 17:09:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1616 https://access.redhat.com/errata/RHSA-2017:1616
Comment 34 Petr Matousek 2017-08-25 09:00:50 UTC 
Statement:

This is a kernel-side mitigation. For a related glibc mitigation please see https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-1000366 .
Note You need to log in before you can comment on or make changes to this bug.