CVE-2017-1000372

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jun 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10003736.5The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that cause CVE-2017-10003749.8A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution us CVE-2017-10003759.8NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily ma CVE-2017-10003767.0libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note CVE-2017-10003775.9An issue was discovered in the size of the default stack guard page on PAX Linux (originally from GRSecurity but shipped by other Linux vend CVE-2017-10003789.8The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes CVE-2017-10003797.8The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped CVE-2017-10003805.5sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users CVE-2017-10003817.5The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the CVE-2017-10003825.5VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files CVE-2017-10003835.5GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting CVE-2017-10003855.9The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker