Skip to content
OpenAdvisories
High · 7.8 Known exploited · Ransomware Public exploit CVE-2017-1000253 EUVD-2017-1514GHSA-rm92-8pw8-34fm

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c8…

Published Oct 4, 2017 · Updated Oct 21, 2025 · Assigned by mitre

Package: linux Package: linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 linux 4.0.2-1 —
Debian 13 linux 4.0.2-1 —
Debian 12 linux 4.0.2-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS linux 3.13.0-57.95 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 perf +17 3.10.0-693.el7 RHSA-2017:1842
RHEL 6 perf +16 2.6.32-696.10.3.el6 RHSA-2017:2795
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Mission Critical 6 perf +9 2.6.32-220.76.1.el6 RHSA-2017:2800
RHEL 7.3 EUS perf +18 3.10.0-514.32.3.el7 RHSA-2017:2793
RHEL 7.2 EUS perf +18 3.10.0-327.59.3.el7 RHSA-2017:2794
RHEL 6.7 EUS perf +16 2.6.32-573.48.1.el6 RHSA-2017:2796
RHEL 6.6 TUS perf +10 2.6.32-504.63.3.el6 RHSA-2017:2797
RHEL 6.6 AUS perf +10 2.6.32-504.63.3.el6 RHSA-2017:2797
RHEL 6.5 TUS perf +10 2.6.32-431.85.1.el6 RHSA-2017:2798
RHEL 6.5 AUS perf +10 2.6.32-431.85.1.el6 RHSA-2017:2798
RHEL 6.4 AUS perf +9 2.6.32-358.84.1.el6 RHSA-2017:2799
RHEL 5.9 AUS kernel +10 2.6.18-348.34.2.el5 RHSA-2017:2802
RHEL 5 ELS kernel +12 2.6.18-423.el5 RHSA-2017:2801

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 11 SP4 kernel-docs 3.0.101-108.13.2 SUSE-SU-2017:2723-1
SLES 11 SP4 kernel-ec2 +8 3.0.101-108.13.1 SUSE-SU-2025:0152-1, SUSE-SU-2017:2723-1
SLES 11 SP3 kernel-ec2 +7 3.0.101-0.47.106.8.1 SUSE-SU-2017:2725-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 11 SP4 kernel-ec2 +8 3.0.101-108.13.1 SUSE-SU-2017:2723-1
SLE Real Time 11 SP4 kernel-rt +3 3.0.101.rt130-69.11.1 SUSE-SU-2017:3165-1
SUSE Linux Enterprise Point of Sale 11 SP3 kernel-ec2 +6 3.0.101-0.47.106.8.1 SUSE-SU-2017:2725-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 16

References