CVE-2017-1000375

NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary code execution. This affects NetBSD 7.1 and possibly earlier versions.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-06-19

Last modified

2024-08-05

Weaknesses

CWE-119

Affected products

• Netbsd (Netbsd)

References

• http://www.securityfocus.com/bid/99257
• https://www.exploit-db.com/exploits/42272/
• https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt