--- id: "CVE-2017-1000253" kind: "vulnerability" aliases: ["CVE-2017-1000253"] title: "Linux distributions that have not patched their long-term kernels with\u2026" severity: "high" cvss: 7.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "centos", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 6.1", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 6.2", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 6.3", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 6.4", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 6.5", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 6.6", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 6.7", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 6.8", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 6.9", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 7.1406", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 7.1503", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 7.1511", "ecosystem": "vendor"}, {"name": "centos", "fixed": [], "affected": "= 7.1611", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.1", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.3", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.5", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.6", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.7", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.8", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 6.9", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 7.1", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 7.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 7.3", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.2.70"], "affected": ">= 2.6.25, < 3.2.70", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.4.109"], "affected": ">= 3.3, < 3.4.109", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.10.77"], "affected": ">= 3.5, < 3.10.77", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.12.43"], "affected": ">= 3.11, < 3.12.43", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.14.41"], "affected": ">= 3.13, < 3.14.41", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.16.35"], "affected": ">= 3.15, < 3.16.35", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.18.14"], "affected": ">= 3.17, < 3.18.14", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["3.19.7"], "affected": ">= 3.19, < 3.19.7", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["4.0.2"], "affected": ">= 4.0, < 4.0.2", "ecosystem": "vendor"}, {"name": "Linux Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "infrastructure", "kubernetes", "linux", "ransomware", "self-hosted"] not_affected_if: ["no-untrusted-local-users", "single-user-machine"] published_at: "2017-10-05T01:29:04+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T00:09:51+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-1000253", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000253", "first_seen_at": "2026-10-23T22:29:05+00:00"}] --- # Linux distributions that have not patched their long-term kernels with… The Linux kernel's ELF loader (load_elf_binary) corrupts the stack when it loads a position-independent executable, which is a memory-corruption flaw. A local user who can run a program can use it to escalate to root. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:centos affected = 6.0 fixed ? - vendor:centos affected = 6.1 fixed ? - vendor:centos affected = 6.2 fixed ? - vendor:centos affected = 6.3 fixed ? - vendor:centos affected = 6.4 fixed ? - vendor:centos affected = 6.5 fixed ? - vendor:centos affected = 6.6 fixed ? - vendor:centos affected = 6.7 fixed ? - vendor:centos affected = 6.8 fixed ? - vendor:centos affected = 6.9 fixed ? - vendor:centos affected = 7.1406 fixed ? - vendor:centos affected = 7.1503 fixed ? - vendor:centos affected = 7.1511 fixed ? - vendor:centos affected = 7.1611 fixed ? - vendor:redhat enterprise linux affected = 6.0 fixed ? - vendor:redhat enterprise linux affected = 6.1 fixed ? - vendor:redhat enterprise linux affected = 6.2 fixed ? - vendor:redhat enterprise linux affected = 6.3 fixed ? - vendor:redhat enterprise linux affected = 6.4 fixed ? - vendor:redhat enterprise linux affected = 6.5 fixed ? - vendor:redhat enterprise linux affected = 6.6 fixed ? - vendor:redhat enterprise linux affected = 6.7 fixed ? - vendor:redhat enterprise linux affected = 6.8 fixed ? - vendor:redhat enterprise linux affected = 6.9 fixed ? - vendor:redhat enterprise linux affected = 7.0 fixed ? - vendor:redhat enterprise linux affected = 7.1 fixed ? - vendor:redhat enterprise linux affected = 7.2 fixed ? - vendor:redhat enterprise linux affected = 7.3 fixed ? - vendor:linux kernel affected >= 2.6.25, < 3.2.70 fixed 3.2.70 - vendor:linux kernel affected >= 3.3, < 3.4.109 fixed 3.4.109 - vendor:linux kernel affected >= 3.5, < 3.10.77 fixed 3.10.77 - vendor:linux kernel affected >= 3.11, < 3.12.43 fixed 3.12.43 - vendor:linux kernel affected >= 3.13, < 3.14.41 fixed 3.14.41 - vendor:linux kernel affected >= 3.15, < 3.16.35 fixed 3.16.35 - vendor:linux kernel affected >= 3.17, < 3.18.14 fixed 3.18.14 - vendor:linux kernel affected >= 3.19, < 3.19.7 fixed 3.19.7 - vendor:linux kernel affected >= 4.0, < 4.0.2 fixed 4.0.2 - vendor:Linux Kernel affected ? fixed ? ## Fix Update the kernel to a release that includes the upstream fix for CVE-2017-1000253, or apply the vendor mitigation; sources do not name the fixed version. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-1000253 - 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-1000253 ## From the sources Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_