Vulnerability record · CVE-2017-1000253 · published 5 October 2017
CVE-2017-1000253: Linux Kernel PIE Binary Stack Buffer Corruption
Centos · Centos
The Linux kernel's load_elf_binary() fails to account for the full size of a PIE binary when mapping it below mm->mmap_base, so later PT_LOAD segments are placed into the stack-binary gap. This corrupts the stack region and is a memory buffer overflow (CWE-119) in unpatched long-term kernels. It matters because it allows local privilege escalation on affected CentOS, Red Hat Enterprise Linux and Linux kernel systems.
Description
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.8, CISA KEV listing with known ransomware use, and high EPSS percentile make this a high-priority local privilege escalation flaw despite requiring local access.
What it is
The Linux kernel's load_elf_binary() fails to account for the full size of a PIE binary when mapping it below mm->mmap_base, so later PT_LOAD segments are placed into the stack-binary gap. This corrupts the stack region and is a memory buffer overflow (CWE-119) in unpatched long-term kernels. It matters because it allows local privilege escalation on affected CentOS, Red Hat Enterprise Linux and Linux kernel systems.
Impact
An attacker with local access can corrupt memory in the stack region and potentially execute code with elevated privileges. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates high confidentiality, integrity and availability impact.
Attack surface
Reached locally by running a crafted PIE binary on an affected kernel; no user interaction is required and the attacker needs only low privileges (PR:L). The vulnerability is in the kernel ELF loader, not a network service.
Exploitation
CISA added it to KEV on 2024-09-09 with a due date of 2024-09-30 and flags known ransomware campaign use; EPSS 30-day probability is 0.10695 (95.578th percentile). Reference tags are advisory and patch only, with no public exploit tag in the record.
What to do
- Apply the vendor kernel updates referenced in the Red Hat errata (RHSA-2017:2793 through RHSA-2017:2802) or the equivalent CentOS/Linux kernel patch.
- If patching is not possible, discontinue use of the affected product per CISA required action.
- Restrict local interactive access and limit low-privileged accounts on affected hosts.
- Verify the kernel includes the fix from commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015).
Detection
- Inventory kernels against the fixed commit/backport and flag hosts still running unpatched long-term kernels.
- Monitor for unexpected local privilege escalation or suspicious PIE binary execution on affected systems.
- Review local account activity for attempts to run crafted binaries that trigger stack-region corruption.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-1000253 to the Known Exploited Vulnerabilities catalog on 9 September 2024 as "Linux Kernel PIE Stack Buffer Corruption Vulnerability ". CISA reports known use in ransomware campaigns. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 30 September 2024.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-1000253 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-1000253), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
