VulnRadar

Data against noise.

Page generated: 11 Nov 2026, 05:26 UTC

CVE-2017-1000253

Read full description

Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.

CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.2/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.8: +1.17
Fresh EPSS: 10.70%: +0.05

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 4 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Oracle Blogs

Press · 24 Mar 2022, 07:00 · Find out what you’re missing with Ksplice Inspector - Oracle Blogs

www.trendmicro.com

Press · 17 Jun 2021, 07:00 · Bash Ransomware DarkRadiation Targets Red Hat- and Debian-based Linux Distributions - www.trendmicro.com

ZDNET

Press · 02 Oct 2017, 07:00 · Serious Linux kernel security bug fixed - ZDNET

Security Affairs

Press · 28 Sep 2017, 07:00 · A high-risk two-years old flaw in Linux kernel was just patched - Security Affairs

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.2 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Source entries and unverified repository candidates are counted separately.

Public exploit evidence

exploitdb #42887 2017-09-26

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.8; EPSS 10.7%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: local access, low privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:47.671864+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

28 Sep 2017, 07:00

Published

04 Oct 2017, 01:00

Latest press mention

24 Mar 2022, 07:00

Added to the CISA KEV catalog

09 Sep 2024, 00:00

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

1 repositories