Description
The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.11.11-1 | — |
| Debian 13 | linux | 4.11.11-1 | — |
| Debian 12 | linux | 4.11.11-1 | — |
| Debian 9 | linux | 4.9.30-2+deb9u5 | DSA-3981-1 |
| Debian 8 | linux | 3.16.43-2+deb8u5 | DSA-3981-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux-raspi-realtime | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv +2 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +3 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +4 | No fix yet | — |
| Ubuntu 16.04 LTS | linux | 4.4.0-93.116 | — |
| Ubuntu 16.04 LTS | linux-aws | 4.4.0-1032.41 | — |
| Ubuntu 16.04 LTS | linux-gcp | 4.13.0-1002.5 | — |
| Ubuntu 16.04 LTS | linux-gke | 4.4.0-1028.28 | — |
| Ubuntu 16.04 LTS | linux-hwe | 4.13.0-32.35~16.04.1 | — |
| Ubuntu 16.04 LTS | linux-raspi2 | 4.4.0-1071.79 | — |
| Ubuntu 16.04 LTS | linux-snapdragon | 4.4.0-1073.78 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux-lts-xenial | 4.4.0-93.116~14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +15 | 2.6.32-754.29.1.el6 | RHSA-2020:1524 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Linux Kernel - 'offset2lib' Stack Clash EDB-42273 · local · Jun 28, 2017 · verified
- Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic Stack Clash' Local Privilege Escalation EDB-42276 · local · Jun 28, 2017 · verified
GitHub 1 repository
-
Trinadh465/linux-4.1.15_CVE-2017-1000371 ★ 0 · Feb 2, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2020:1524 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-3981-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
- 99131 vdb-entry
- DSA-3981 vendor-advisory
- 42276 exploit
- 42273 exploit
- https://access.redhat.com/security/cve/CVE-2017-1000371