CVE-2016-4997

HIGH

Linux Kernel 4.6.3 Netfilter Privilege Escalation

Title source: metasploit

Exploitation Summary

EIP tracks 3 public exploits for CVE-2016-4997. PoCs published by Metasploit, Qian Zhang, h00die <[email protected]>, vnik, Jesse Hertz, Tim Newsham, including Metasploit module exploits/linux/local/netfilter_priv_esc_ipv4.

AI-analyzed exploit summary This Metasploit module exploits CVE-2016-4997, a Linux kernel netfilter privilege escalation vulnerability affecting Ubuntu 16.04 with kernel 4.4.0-21-generic. It compiles and executes a C-based exploit to gain elevated privileges by manipulating netfilter structures.

Description

The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.

Exploits (3)

exploitdb WORKING POC VERIFIED

by Metasploit · rubylocallinux_x86

https://www.exploit-db.com/exploits/40435

View Code ZIP pw:eip

This Metasploit module exploits CVE-2016-4997, a Linux kernel netfilter privilege escalation vulnerability affecting Ubuntu 16.04 with kernel 4.4.0-21-generic. It compiles and executes a C-based exploit to gain elevated privileges by manipulating netfilter structures.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Linux Kernel < 4.6.3 (Ubuntu 16.04 with kernel 4.4.0-21-generic)

No auth needed

Prerequisites: ip_tables.ko loaded · libc6-dev-i386 installed · gcc-multilib installed · gcc installed

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548.001 - Setuid and Setgid

devstral-2 · analyzed Feb 16, 2026 Full analysis →

exploitdb WORKING POC

by Qian Zhang · textlocallinux

https://www.exploit-db.com/exploits/40489

View Code ZIP pw:eip

This exploit leverages a vulnerability in the IPv6 netfilter subsystem of the Linux kernel (CVE-2016-4997) to escalate privileges via an IP6T_SO_SET_REPLACE compat setsockopt call. It requires the ip6_tables module to be loaded and demonstrates a successful local privilege escalation to root.

Classification

Working Poc 100%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Linux kernel <= 4.6.2

Auth required

Prerequisites: ip6_tables module loaded · local user access

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC GOOD

by h00die <[email protected]>, vnik, Jesse Hertz, Tim Newsham · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb

View Code ZIP pw:eip

This Metasploit module exploits a netfilter bug in Linux kernels before 4.6.3, specifically targeting Ubuntu 16.04 with kernel 4.4.0-21-generic. It leverages a privilege escalation vulnerability (CVE-2016-4997) by compiling and executing a crafted exploit on the target system.

Classification

Working Poc 100%

Attack Type

Lpe

Complexity

Moderate

Reliability

Racy

Target: Linux Kernel < 4.6.3 (Ubuntu 16.04 with kernel 4.4.0-21-generic)

No auth needed

Prerequisites: ip_tables.ko loaded · libc6-dev-i386 installed · gcc-multilib installed · SMEP/SMAP disabled · Unprivileged user namespaces enabled

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548 - Abuse Elevation Control Mechanism

devstral-2 · analyzed Apr 23, 2026 Full analysis →

References (43)

Core 43

Core References

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00060.html

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3017-3

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-1847.html

Issue Tracking, Third Party Advisory x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=1349722

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3018-2

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00048.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3017-2

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-1875.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3019-1

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00027.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3607

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3016-2

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3016-1

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/06/24/5

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00054.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00051.html

Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/40435/

Patch, Third Party Advisory x_refsource_confirm

https://github.com/torvalds/linux/commit/ce683e5f9d045e5d67d1312a42b359cb2ab2a13c

View Patch ZIP pw:eip

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3018-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1036171

Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/40489/

Third Party Advisory x_refsource_confirm

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05347541

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00050.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-1883.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00052.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3016-3

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00061.html

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/09/29/10

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3016-4

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/91451

Vendor Advisory x_refsource_confirm

http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.3

Vendor Advisory x_refsource_confirm

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d045e5d67d1312a42b359cb2ab2a13c

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3020-1

Exploit, Third Party Advisory x_refsource_misc

https://github.com/nccgroup/TriforceLinuxSyscallFuzzer/tree/master/crash_reports/report_compatIpt

View Exploit ZIP pw:eip

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00053.html

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-3017-1

Scores

CVSS v3 7.8

EPSS 0.0549

EPSS Percentile 90.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-264

Status published

Products (14)

canonical/ubuntu_linux 12.04

canonical/ubuntu_linux 14.04

canonical/ubuntu_linux 15.10

canonical/ubuntu_linux 16.04

debian/debian_linux 8.0

linux/linux_kernel 2.6.17 - 3.2.80

novell/suse_linux_enterprise_desktop 12.0 (2 CPE variants)

novell/suse_linux_enterprise_live_patching 12.0

novell/suse_linux_enterprise_module_for_public_cloud 12.0

novell/suse_linux_enterprise_real_time_extension 12.0 sp1

... and 4 more

Published Jul 03, 2016

Tracked Since Feb 18, 2026