CVE-2017-1000253
HighExploitedPublic exploitLinux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015).
Published Oct 5, 2017 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2017-1000253, SUSE-SU-2017:2723-1, SUSE-SU-2017:2725-1, SUSE-SU-2017:3165-1, SUSE-SU-2025:0152-1, UBUNTU-CVE-2017-1000253
Key Facts
Patch immediately- CVE-2017-1000253 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Centos, Linux Kernel, Enterprise Linux (Redhat) and 22 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 17, 2021 and is known to be used in ransomware campaigns. Public exploit code is available.
- EPSS estimates a 11% probability of exploitation in the next 30 days.
- Fixed versions are available, including kernel 0:2.6.18-348.34.2.el5, kernel 0:2.6.32-431.85.1.el6, kernel 0:3.10.0-693.el7.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
11%
Higher than 95.7% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings, used by ransomware
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2017-1000253 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Sep 9, 2024 | Sep 30, 2024 | Known |
| Industry KEV feed | Jun 17, 2021 | Sep 30, 2024 | Known |
| CIRCL KEV | Sep 9, 2024 | Sep 30, 2024 | Known |
| ENISA EUVD | Sep 9, 2024 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Products
255 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| CentosCentos | 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7 | n/a |
| Linux KernelLinux | See advisory | 3.2.70 |
| Enterprise LinuxRedhat | 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7 | n/a |
| linuxdebian | See advisory | 4.0.2-1 |
| rootio-linuxrootio | See advisory | 4.0.2-1 |
Patched Releases
kernel
0:2.6.18-348.34.2.el5, 0:2.6.32-431.85.1.el6, 0:3.10.0-693.el7, 2.6.18-419.0.0.0.4.el5, 2.6.18-419.0.0.0.5.el5, 2.6.32-696.10.3.el6, 4.1.10-17.31.amzn1
kernel-abi-whitelists
2.6.32-696.10.3.el6
kernel-bigmem
3.0.101-108.13.1
kernel-bigmem-base
3.0.101-108.13.1
kernel-bigmem-devel
3.0.101-108.13.1
kernel-bigsmp
3.0.101-0.47.106.8.1
kernel-bigsmp-base
3.0.101-0.47.106.8.1
kernel-bigsmp-devel
3.0.101-0.47.106.8.1
kernel-debug
2.6.18-419.0.0.0.4.el5, 2.6.18-419.0.0.0.5.el5, 2.6.32-696.10.3.el6
kernel-debug-devel
2.6.18-419.0.0.0.4.el5, 2.6.18-419.0.0.0.5.el5, 2.6.32-696.10.3.el6
kernel-debuginfo-common-i686
4.1.10-17.31.amzn1
kernel-debuginfo-common-x86_64
4.1.10-17.31.amzn1
kernel-default
3.0.101-0.47.106.8.1, 3.0.101-108.13.1, 3.0.101-108.174.1
kernel-default-base
3.0.101-0.47.106.8.1, 3.0.101-108.13.1, 3.0.101-108.174.1
kernel-default-devel
3.0.101-0.47.106.8.1, 3.0.101-108.13.1, 3.0.101-108.174.1
kernel-default-man
3.0.101-0.47.106.8.1, 3.0.101-108.13.1
kernel-devel
2.6.18-419.0.0.0.4.el5, 2.6.18-419.0.0.0.5.el5, 2.6.32-696.10.3.el6, 4.1.10-17.31.amzn1
kernel-doc
2.6.18-419.0.0.0.4.el5, 2.6.18-419.0.0.0.5.el5, 2.6.32-696.10.3.el6, 4.1.10-17.31.amzn1
kernel-docs
3.0.101-108.13.2
kernel-ec2
3.0.101-0.47.106.8.1, 3.0.101-108.13.1, 3.0.101-108.174.1
kernel-ec2-base
3.0.101-0.47.106.8.1, 3.0.101-108.13.1, 3.0.101-108.174.1
kernel-ec2-devel
3.0.101-0.47.106.8.1, 3.0.101-108.13.1, 3.0.101-108.174.1
kernel-firmware
2.6.32-696.10.3.el6
kernel-headers
2.6.18-419.0.0.0.4.el5, 2.6.18-419.0.0.0.5.el5, 2.6.32-696.10.3.el6, 4.1.10-17.31.amzn1
kernel-PAE
3.0.101-0.47.106.8.1, 3.0.101-108.13.1, 2.6.18-419.0.0.0.4.el5
Timeline
Publicly disclosed
Oct 5, 2017
Added to Industry KEV feed
Jun 17, 2021
Added to CISA KEV
Sep 9, 2024
Added to CIRCL KEV
Sep 9, 2024
Added to ENISA EUVD
Sep 9, 2024
Last updated
Aug 4, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- advisoryRHSA-2017:1842
- advisoryRHSA-2017:2793
- advisoryRHSA-2017:2794
- advisoryRHSA-2017:2795
- advisoryRHSA-2017:2796
FAQ
Common Questions.
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015).
Affected: Centos versions 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7; Linux Kernel; Enterprise Linux (Redhat) versions 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 17, 2021 and is known to be used in ransomware campaigns.
Yes. It was added on Sep 9, 2024 with a federal remediation due date of Sep 30, 2024.
Public exploit code is available.
Fixed versions are available, including kernel 0:2.6.18-348.34.2.el5, kernel 0:2.6.32-431.85.1.el6, kernel 0:3.10.0-693.el7.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2017-1000253 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo