Synology-SA-17:22 Stack Clash

Publish Time: 2017-06-20 00:00:00 UTC+8

Last Updated: 2017-11-30 17:37:02 UTC+8

Severity
Moderate
Status
Resolved

Abstract

The Stack Clash is a vulnerability in the memory management which allows local authenticated users to corrupt memory and obtain full root privileges.

The vulnerability has a low impact on x86-64 models.

Severity

Moderate

CVSSv3 Base Score: 7.7

Affected

  • Products
    • DSM 6.1
    • DSM 6.0
    • DSM 5.2
    • SRM 1.1
  • Models
    • All Synology models

Description

  • CVE-2017-1000364
    An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).

  • CVE-2017-1000366
    glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

Mitigation

We are now working on a solution to this vulnerability. For an immediate workaround, please contact us at security@synology.com.

Update Availability

To fix the security issue, please update DSM 6.1 to 6.1.3-15152-3 or above, update DSM 6.0 to 6.0.3-8754-6 or above, update DSM 5.2 to 5.2-5967-5 or above, and SRM 1.1 to 1.1.5-6542 or above.

References