CVE-2005-3257

Linux Kernel 2.6.12 - Privilege Escalation via KDSKBSENT ioctl

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-3257. PoCs published by Rudolf Polzer.

AI-analyzed exploit summary This exploit leverages a Linux kernel vulnerability (CVE-2005-3257) where unprivileged users can modify the console keymap to inject arbitrary commands. The provided `loadkeys` command redefines a key to execute a scripted macro, potentially leading to privilege escalation when another user interacts with the console.

Description

The VT implementation (vt_ioctl.c) in Linux kernel 2.6.12, and possibly other versions including 2.6.14.4, allows local users to use the KDSKBSENT ioctl on terminals of other users and gain privileges, as demonstrated by modifying key bindings using loadkeys.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Rudolf Polzer · textlocallinux
https://www.exploit-db.com/exploits/26353

This exploit leverages a Linux kernel vulnerability (CVE-2005-3257) where unprivileged users can modify the console keymap to inject arbitrary commands. The provided `loadkeys` command redefines a key to execute a scripted macro, potentially leading to privilege escalation when another user interacts with the console.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Linux kernel (versions affected by CVE-2005-3257)
No auth needed
Prerequisites: Local access to the system · Unprivileged user account
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (18)

Core 18
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHBA-2007-0304.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2005:235
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10615
Vendor Advisory vendor-advisory x_refsource_mandrake
http://www.mandriva.com/security/advisories?name=MDKSA-2005:220
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19369
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/18203
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/17226
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1018
Exploit, Vendor Advisory x_refsource_confirm
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=334113
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19185
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/15122
Vendor Advisory vendor-advisory x_refsource_mandrake
http://www.mandriva.com/security/advisories?name=MDKSA-2005:218
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/17826
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1017
Vendor Advisory vendor-advisory x_refsource_mandrake
http://www.mandriva.com/security/advisories?name=MDKSA-2005:219
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19374
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/231-1/
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/17995

Scores

EPSS 0.0106
EPSS Percentile 61.1%

Details

CWE
CWE-264
Status published
Products (2)
linux/linux_kernel 2.6.12
linux/linux_kernel 2.6.14.4
Published Oct 18, 2005
Tracked Since Feb 18, 2026