VulnerabilityModified
CVE-2017-1000374
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries.
CRITICAL 9.8EPSS 3.43%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.43% probability · 88th percentile
- CISA KEV
- Not listed
- Affected
- netbsd/netbsd
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/99176Third Party Advisory, VDB Entry
- https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtMailing List, Third Party Advisory
- http://www.securityfocus.com/bid/99176Third Party Advisory, VDB Entry
- https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtMailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.