Actively exploited in the wild
Linux Kernel PIE Stack Buffer Corruption Vulnerability
Linux - Kernel · Listed in the CISA KEV since 2024-09-09. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2017-1000253
HighCVSS 7.8KEVSummary
Podatność dotyczy dystrybucji Linuksa, które nie załatały swoich długoterminowych jąder zgodnie z poprawką z kwietnia 2015 roku. Problem występuje w funkcji load_elf_binary(), która nie przydziela wystarczającej przestrzeni dla całego binarnego pliku PIE, co prowadzi do nieprawidłowego mapowania segmentów.
Risk Assessment
Niezastosowanie poprawki może prowadzić do nieautoryzowanego dostępu do pamięci, co stwarza ryzyko dla integralności i poufności danych w systemie. Organizacje mogą być narażone na ataki wykorzystujące tę lukę.
Recommendation
Zaleca się, aby administratorzy systemów Linuksowych zaktualizowali swoje jądra do wersji zawierających poprawkę a87938b2e246b81b4fb713edb371a9fa3c5c3c86. Regularne aktualizowanie systemów operacyjnych jest kluczowe dla zapewnienia bezpieczeństwa.
Related vulnerabilities
- CVE-2026-87886HighActively exploited
The vulnerability is a local privilege escalation due to insecure file permissions. It affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85889Critical
Missing authentication for a critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-85885Critical
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
- CVE-2026-83944Critical
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-77903Critical
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70200Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69865Critical
Authorization bypass through a user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
Original NVD description (English source)
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.