Exploitation Summary
EIP tracks 3 public exploits for CVE-2016-6187. PoCs published by Vitaly Nikolenko, Milo-D, vnik5287.
AI-analyzed exploit summary This exploit leverages a heap off-by-one vulnerability (CVE-2016-6187) in the Linux kernel's message queue implementation to achieve arbitrary code execution by manipulating kernel memory structures. It uses userfaultfd to control page faults and trigger the vulnerability, ultimately forcing the kernel to execute instructions from a controlled address (0xdeadbeef).
Description
The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 4.6.5 does not validate the buffer size, which allows local users to gain privileges by triggering an AppArmor setprocattr hook.
Exploits (3)
This exploit leverages a heap off-by-one vulnerability (CVE-2016-6187) in the Linux kernel's message queue implementation to achieve arbitrary code execution by manipulating kernel memory structures. It uses userfaultfd to control page faults and trigger the vulnerability, ultimately forcing the kernel to execute instructions from a controlled address (0xdeadbeef).
This repository contains a functional local privilege escalation exploit for CVE-2016-6187, targeting Linux kernels < 4.6.5. The exploit leverages a heap-based nullbyte overflow in AppArmor's LSM hooks to achieve arbitrary memory corruption, bypass KASLR/SMEP/SMAP, and escalate privileges to root.
This repository contains a functional proof-of-concept exploit for CVE-2016-6187, a heap off-by-one vulnerability in the Linux kernel. The exploit leverages userfaultfd to manipulate kernel memory and achieve arbitrary code execution by redirecting execution to 0xdeadbeef.
References (7)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H