CVE-2017-1000253

HIGH7.8

CISA KEV

Published 2017-10-05 · Updated 2026-06-17 · Source cve@mitre.org

Summary

CVE-2017-1000253 is a high-severity (CVSS 7.8) vulnerability in Linux Kernel. CISA added it to the Known Exploited Vulnerabilities catalog on September 9, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 30, 2024. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Linux has 32 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

All 32 known-exploited Linux vulnerabilities →

Description

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-119CWE-119

CISA Known-Exploited Vulnerability

Product: Linux — Kernel

Name: Linux Kernel PIE Stack Buffer Corruption Vulnerability

Date added: 2024-09-09 · Due: 2024-09-30

USED IN RANSOMWARE

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

View on NVD

More exploited Linux vulnerabilities

Most recently added to CISA KEV

CVE-2026-46300
Kernel — Linux Kernel Missing Initialization of a Variable Vulnerability
added 2026-10-28
CVE-2025-39964
Kernel — Linux Kernel Race Condition Vulnerability
added 2026-09-18
CVE-2026-53266
Kernel — Linux Kernel Out-of-Bounds Write Vulnerability
added 2026-09-18
CVE-2025-39682
Kernel — Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
added 2026-09-18
CVE-2026-53362
Kernel — Linux Kernel Unspecified Vulnerability
added 2026-08-27
CVE-2022-0995
Kernel — Linux Kernel Out-of-Bounds Write Vulnerability
added 2026-08-26

View all →

Related CVEs

Same severity, most recent

CVE-2026-120531
The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
2026-11-07 · score 7.2
CVE-2026-123991
A vulnerability was detected in DataEase up to 2.10.27. Affected by this vulnerability is the function WhitelistUtils.endsWithAny of the file WhitelistUtils.java of the component Authentication Filter. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.10.28 addresses this issue. It is advisable to upgrade the affected component. The vendor confirms: "This issue has been addressed by enforcing authentication on the standalone static-resource upload endpoint independently of the URI suffix whitelist."
2026-11-07 · score 7.3
CVE-2026-123990
A security vulnerability has been detected in DataEase up to 2.10.27/3.1.0. Affected is the function ExtWhere2Str.extWhere2sqlOjb of the file engine/trans/ExtWhere2Str.java of the component Chart Data Handler. Such manipulation of the argument operator leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.0 is able to address this issue. Upgrading the affected component is advised. The vendor confirms: "The fix validates the complete compound operator and uses fixed AND / OR keywords instead of concatenating user-controlled logic into SQL."
2026-11-07 · score 7.3
CVE-2026-124318
Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord format_strings field through the Django admin, executing Python code as the web server user when news feeds render.
2026-11-07 · score 7.2
CVE-2026-123963
A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file im_server/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
2026-11-07 · score 7.3