CVE-2017-1000373

EPSS 13.4%

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 13.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

19 Jun 2017Published on NVD

28 Jun 2017Public PoC

Weaponization speed

8 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects OpenBSD 6.1 and possibly earlier versions.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/42271/unverified exploitdbwww.exploit-db.com/exploits/42271unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/qsort.c?rev=1.15&content-type=text/x-cvsweb-markup https://support.apple.com/HT208112 https://support.apple.com/HT208113 https://support.apple.com/HT208115 https://support.apple.com/HT208144 https://www.exploit-db.com/exploits/42271/https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt http://www.securityfocus.com/bid/99177 http://www.securitytracker.com/id/1039427