Listen to this Post
The vulnerability is an integer overflow in the kernel’s `create_elf_tables()` function, which sets up the memory layout for a new process. When preparing the stack for an ELF binary, this function calculates the total size needed for both the ELF auxiliary vectors (like AT_PHDR, AT_ENTRY) and the program arguments/environment strings. The flaw occurs when these two size values are added together without proper bounds checking. On 64-bit systems, if an attacker supplies a sufficiently large number of arguments and environment variables, this sum can exceed the maximum value of a 32-bit integer, causing an integer wrap-around to a much smaller value. The kernel then incorrectly calculates the final stack pointer position based on this overflowed size. By carefully crafting the argument list, a local attacker can exploit this miscalculation to place malicious data, such as new environment variables, at a chosen location on the stack of a privileged SUID binary. When the SUID binary executes, it may then use this attacker-controlled data, leading to arbitrary code execution with root privileges. Successful exploitation requires significant available memory (typically >32GB) to create the necessary large argument space.
Platform: Linux Kernel
Version: 2.6.x/3.10.x/4.14.x
Vulnerability: Integer Overflow
Severity: High
date: 2018-09-25
Prediction: 2018-10-16
What Undercode Say:
SystemTap mitigation script from vendor advisory
stap -g cve_mitigation.stp
Check kernel version
uname -r
Example script to clamp stack limit
cat > cve_mitigation.stp << 'EOF'
probe kernel.function("copy_strings").call {
// ... clamping code from Red Hat advisory
}
EOF
How Exploit:
Local attacker crafts excessive arguments and environment variables for a SUID binary, triggering integer overflow in stack size calculation during execve(). This corrupts the stack layout, allowing attacker-controlled data to be interpreted by the privileged process, leading to root shell execution.
Protection from this CVE
Apply kernel patches from distributor. Use provided SystemTap script to temporarily clamp stack limit. Restrict access to SUID binaries. Ensure systems have less than 32GB RAM to limit exploitability (for affected versions).
Impact:
Local privilege escalation to root. Complete compromise of affected system. Impacts 64-bit systems with sufficient memory. Does not affect 32-bit architectures.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
