{"id":"CVE-2017-1000253","kind":"vulnerability","aliases":["CVE-2017-1000253"],"related":[],"title":"Linux distributions that have not patched their long-term kernels with…","description":"Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the \"gap\" between the stack and the binary.","summary":"The Linux kernel's ELF loader (load_elf_binary) corrupts the stack when it loads a position-independent executable, which is a memory-corruption flaw. A local user who can run a program can use it to escalate to root.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-09-09T00:00:00+00:00","products":[{"name":"centos","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 6.1","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 6.2","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 6.3","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 6.4","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 6.5","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 6.6","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 6.7","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 6.8","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 6.9","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 7.1406","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 7.1503","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 7.1511","ecosystem":"vendor"},{"name":"centos","fixed":[],"affected":"= 7.1611","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.1","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.2","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.3","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.4","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.5","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.6","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.7","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.8","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.9","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 7.1","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 7.2","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 7.3","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.2.70"],"affected":">= 2.6.25, < 3.2.70","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.4.109"],"affected":">= 3.3, < 3.4.109","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.10.77"],"affected":">= 3.5, < 3.10.77","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.12.43"],"affected":">= 3.11, < 3.12.43","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.14.41"],"affected":">= 3.13, < 3.14.41","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.16.35"],"affected":">= 3.15, < 3.16.35","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.18.14"],"affected":">= 3.17, < 3.18.14","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.19.7"],"affected":">= 3.19, < 3.19.7","ecosystem":"vendor"},{"name":"linux kernel","fixed":["4.0.2"],"affected":">= 4.0, < 4.0.2","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","ransomware","self-hosted"],"not_affected_if":["no-untrusted-local-users","single-user-machine"],"how_to_check":null,"fix":"Update the kernel to a release that includes the upstream fix for CVE-2017-1000253, or apply the vendor mitigation; sources do not name the fixed version.","status":"open","published_at":"2017-10-05T01:29:04+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:13+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:58:13Z","model":"claude-haiku-5-5","output":{"fix":"Update the kernel to a release that includes the upstream fix for CVE-2017-1000253, or apply the vendor mitigation; sources do not name the fixed version.","reach":"local","impact":"high","summary":"The Linux kernel's ELF loader (load_elf_binary) corrupts the stack when it loads a position-independent executable, which is a memory-corruption flaw. A local user who can run a program can use it to escalate to root.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes"],"confidence":0.7,"needs_auth":"yes","worst_case":"local user gains root privileges on the machine","analyst_note":"Confirm fixed kernel versions and distro patch status from the NVD or vendor advisories; CISA KEV lists it as known ransomware-exploited.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["single-user-machine","no-untrusted-local-users"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000463,"input_tokens":2829,"output_tokens":361,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1000253':14A,17A '-2017':13A,16A '/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86':158C '14':162C '2015':163C,171C,181C '3.10.77':178C 'a87938b2e246b81b4fb713edb371a9fa3c5c3c86':174C 'account':234C 'address':205C,220C 'alloc':206C,239C 'april':161C,170C 'arch':193C 'attempt':212C 'backport':175C 'base':226C,260C,274C 'binari':110B,210C,217C,230C,245C,290C 'binfmt':194C 'centos':18A,19A,20A,21A,22A,23A,24A,25A,26A,27A,28A,29A,30A,31A 'commit':159C,173C 'config':192C 'corrupt':111B,127B 'cve':12A,15A 'distribut':2A,145C 'elf':106B,109B,195C,209C,229C 'enabl':198C 'end':267C 'enterprise':33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A 'entir':244C 'escal':141B 'execut':121B 'exploit':94B 'first':251C 'fix':168C 'flaw':128B 'gap':284C 'git.kernel.org':157C 'git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86':156C 'host':101B 'immedi':222C 'independ':120B 'infrastructur':95B 'kernel':11A,75A,77A,79A,81A,83A,85A,87A,89A,91A,93A,104B,154C,165C 'kubernet':96B 'linux':1A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,74A,76A,78A,80A,82A,84A,86A,88A,90A,92A,97B,103B,144C,177C 'load':108B,116B,208C,228C,253C,264C 'loader':107B 'local':130B 'long':9A,152C 'long-term':8A,151C 'map':214C,256C,270C 'may':180C 'mean':247C 'memori':126B 'memory-corrupt':125B 'mm':224C,258C,272C 'mmap':225C,259C,273C 'need':237C 'normal':201C 'patch':6A,149C 'pie':197C,216C 'posit':119B 'position-independ':118B 'program':136B 'pt':252C,263C 'random':196C 'rang':221C 'ransomwar':98B 'recogn':186C 'redhat':32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A 'root':143B 'run':134B 'secur':189C 'segment':254C,265C 'self':100B 'self-host':99B 'space':241C 'stack':113B,287C 'strategi':207C 'subsequ':262C 'suffici':240C 'suppos':280C 'take':233C 'term':10A,153C 'threat':190C 'top':203C 'top-down':202C 'unfortun':227C 'use':138B 'user':131B 'vulner':166C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-10-05T01:29:04+00:00","kev":{"dateAdded":"2024-09-09","dueDate":"2024-09-30","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-1000253","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-1000253","severity":null,"published_at":"2024-09-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-1000253","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000253","severity":null,"published_at":"2017-10-05T01:29:04+00:00","modified_at":"2026-06-17T00:58:59+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}