7.8

CVE-2017-1000379: linux linux_kernel

Modified
AliasesUBUNTU-CVE-2017-1000379DEBIAN-CVE-2017-1000379
Published 19-06-2017Last modified 05-08-2024

Vulnerability summary

CVE-2017-1000379 is a high (CVSS 7.8) vulnerability in linux linux_kernel. EPSS estimates a 1.75% chance of exploitation in the next 30 days, higher than 77.9% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 28-06-2017)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
1.75%
0%100%
Low · -0.08 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 12
RHSA-2017:1482RHSA-2017:1484RHSA-2017:1485RHSA-2017:1486RHSA-2017:1487RHSA-2017:1488

Timeline

  1. 19-06-2017
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.

CVSS metrics

5 scores · 3 sources · 3 versions

EPSS trend

Probability

1.75%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

Decrease -0.08 pp

From 1.83% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • exploit-databaselocallinux_x86-64Verified

    Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64 Stack Clash' Local Privilege Escalation

    Maturity: weaponized

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu12 products
  • linux< 3.13.0-121.170 | < 4.4.0-81.104
  • linux-aws< 4.4.0-1020.29
  • linux-azure-fdeAll versions (No fix recorded)
  • linux-gke< 4.4.0-1016.16 | All versions (No fix recorded)
  • linux-hwe< 4.8.0-56.61~16.04.1
Debian1 product
  • linux< 4.11.6-1
Linux1 product
  • linux_kernel≥ 2.6.12, < 3.2.90 | ≥ 3.3, < 3.10.107 | ≥ 3.11, < 3.16.45 | ≥ 3.17, < 3.18.58 | ≥ 3.19, < 4.1.42 | ≥ 4.2, < 4.4.74 | ≥ 4.5, < 4.9.34 | ≥ 4.10, < 4.11.7

3 vendors · 14 products

References

20 links
Show all 20 references