CVE-2017-1000365

What it actually does

The Linux kernel fails to account for argument and environment pointers when enforcing the RLIMIT_STACK/RLIM_INFINITY size limit (1/4 of stack size), allowing bypass of the restriction on argv/envp data passed via execve in versions 4.11.5 and earlier.

Why it matters to the business

Systems running affected kernels remain exposed to local attacks that can lead to full compromise, increasing operational risk and potential downtime even years after disclosure, with broad impact across Linux deployments due to high ecosystem prevalence.

How an attack unfolds

A local attacker invokes processes using execve with carefully sized argv and envp arrays that exceed the documented limit by omitting pointer overhead, bypassing the kernel check to deliver oversized payloads that may enable further exploitation such as privilege escalation.

How to fix it

Upgrade all affected Linux kernels to versions after 4.11.5; rebuild and reboot systems with the patched kernel; verify no custom builds retain the flawed stack-limit logic.

How to confirm the fix worked

Run uname -r to confirm kernel > 4.11.5; execute test programs that attempt oversized argv/envp under RLIMIT_STACK and confirm the kernel now enforces the limit including pointers.

Typical attack path

1. Confirm target runs Linux kernel 4.11.5 or earlier
2. Craft execve call with argv/envp exceeding the 1/4 RLIMIT_STACK limit via pointer omission
3. Trigger process execution to bypass size enforcement
4. Leverage oversized data to facilitate local privilege escalation or kernel memory corruption

How to detect it

Review audit logs and process creation events for execve calls carrying unusually large argv or envp arrays; correlate with kernel version checks in system inventory; examine any post-exploitation artifacts from local escalation attempts.

What your security team should do

• Immediately inventory and upgrade all Linux systems to patched kernels
• Enforce least-privilege execution and restrict local user capabilities pending patches
• Add kernel version checks to vulnerability scanning and asset management processes