Stack clash vulnerability is smashing Linux defenses to compromise root privileges

Original link

Linux, BSD, Solaris, and other open-source systems are susceptible to a local privilege escalation vulnerability, "Stack clash," which can be exploited by attackers to smash Linux defenses and gain root privileges to execute code, according to security vendor Qualys researchers.

Qualys that the high-risk vulnerability exists on the stack, bypassing the Stack guard page mitigations introduced in Linux in 2010 and into the memory area, which should not be used to execute code. By design, this stack memory area contains a mechanism that expands when the program needs more stack memory, but this extension is a security threat.

The vulnerability is cve-2017-1000364, and the researcher points out that the current attacker was able to connect the vulnerability to other important issues, such as the recently resolved Sudo vulnerability, to gain full root privileges and execute arbitrary code.

Qualys said the possibility of not fully excluding the vulnerability could be exploited remotely, which is at the application level, and the company is currently focusing on the local privilege escalation level.

Qualys's security report was released on June 19, while the patch for the Linux/unix release was released. Linux, OpenBSD, NetBSD, FreeBSD, or Solaris systems running on i386 or AMD6 hardware will be affected. Other operating systems may also be vulnerable, but have not yet been tested.

It is reported that Red Hat has released a bulletin on the "Stack clash" vulnerability on June 20, saying that it is possible to mitigate the vulnerability by setting the hard Rlimit Stack and rlimit_as of local Users and remote services to a low value, but this can cause some performance problems as it /Proc/meminfo to create overlapping values. However, normal operation is not affected. Patches that formally address these issues will be released as soon as possible.

Original link

Stack clash vulnerability is smashing Linux defenses to compromise root privileges