CVE-2017-1000364
HighAn issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).
CVSS 3.0 score
7.4
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness type
CWE-119CVE-2017-1000364 is a Buffer Overflow vulnerability
What is Buffer Overflow?
The product performs operations on a memory buffer but reads or writes outside its intended boundaries. Learn more on MITRE CWE
References
The following references provide additional information about CVE-2017-1000364 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
Debian Securityhttp://www.debian.org/security/2017/dsa-3886
-
Securityfocushttp://www.securityfocus.com/bid/99130Issue Tracking VDB Entry
-
Securitytrackerhttp://www.securitytracker.com/id/1038724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Third Party Advisory VDB Entry
-
-
-
Supporthttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03800en_us
-
Exploit-DBhttps://www.exploit-db.com/exploits/45625/
-
Third Party Advisory
-
Third Party Advisory
-
Third Party Advisory
Frequently asked questions
-
What is CVE-2017-1000364?
CVE-2017-1000364 is a High severity Linux kernel vulnerability with a CVSS score of 7.4 out of 10 , classified as a Buffer Overflow flaw (CWE-119) . CVE-2017-1000364 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
What is the CVSS score for CVE-2017-1000364?
CVE-2017-1000364 has a CVSS score of 7.4 out of 10, rated High severity (CVSS 3.0). The vector string is
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. -
Is there a patch available for CVE-2017-1000364?
No patch is currently available for CVE-2017-1000364. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
-
Is CVE-2017-1000364 actively exploited?
No — CVE-2017-1000364 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
-
What is Buffer Overflow (CWE-119)?
The product performs operations on a memory buffer but reads or writes outside its intended boundaries. View CWE-119 on MITRE CWE →