Exploitation Summary
EIP tracks 3 public exploits for CVE-2016-4557.
PoCs published by Metasploit, Google Security Research, [email protected], h00die <[email protected]>, including Metasploit module exploits/linux/local/bpf_priv_esc.
AI-analyzed exploit summary This Metasploit module exploits CVE-2016-4557, a Linux BPF local privilege escalation vulnerability. It leverages BPF syscalls to manipulate file descriptors and achieve root privileges on vulnerable systems.
Description
The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.
Exploits (3)
This Metasploit module exploits CVE-2016-4557, a Linux BPF local privilege escalation vulnerability. It leverages BPF syscalls to manipulate file descriptors and achieve root privileges on vulnerable systems.
This exploit leverages a use-after-free vulnerability in the Linux kernel's eBPF subsystem (CVE-2016-4557) to achieve local privilege escalation. The flaw arises from a double fdput() call when handling invalid eBPF map file descriptors, allowing an attacker to manipulate file references and gain root access.
This Metasploit module exploits CVE-2016-4557, a use-after-free vulnerability in the Linux kernel's eBPF subsystem, to achieve local privilege escalation. It targets Linux kernel versions 4.4 to 4.5.5 by manipulating file descriptors and requires specific kernel configurations.
References (9)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H