CVE-2016-8655

HIGH

AF_PACKET chocobo_root Privilege Escalation

Title source: metasploit
STIX 2.1

Exploitation Summary

EIP tracks 9 public exploits for CVE-2016-8655. PoCs published by Metasploit, rebel, bcoles, including Metasploit module exploits/linux/local/af_packet_chocobo_root_priv_esc.

AI-analyzed exploit summary This Metasploit module exploits a race condition and use-after-free vulnerability in the Linux kernel's AF_PACKET implementation (CVE-2016-8655) to achieve local privilege escalation. It includes bypasses for SMEP, SMAP, and KASLR, and targets Ubuntu-based systems with vulnerable kernel versions.

Description

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.

Exploits (9)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/44696

This Metasploit module exploits a race condition and use-after-free vulnerability in the Linux kernel's AF_PACKET implementation (CVE-2016-8655) to achieve local privilege escalation. It includes bypasses for SMEP, SMAP, and KASLR, and targets Ubuntu-based systems with vulnerable kernel versions.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel versions 4.4.0 < 4.4.0-53.74 (Ubuntu Trusty/Xenial and derivatives)
No auth needed
Prerequisites: Unprivileged user namespaces enabled · Two or more CPU cores · Vulnerable kernel version
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by rebel · clocallinux_x86-64
https://www.exploit-db.com/exploits/40871

This exploit leverages a race condition in the Linux kernel's AF_PACKET implementation (CVE-2016-8655) to achieve local privilege escalation. It manipulates kernel memory to overwrite critical structures, ultimately gaining root access.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel 4.4.0-51-generic and similar versions
No auth needed
Prerequisites: Local access to the target system · Kernel version vulnerable to CVE-2016-8655
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by bcoles · clocalwindows_x86-64
https://www.exploit-db.com/exploits/47170

This is a working exploit for CVE-2016-8655, a race condition in the Linux kernel's AF_PACKET implementation. It includes KASLR and SMEP/SMAP bypasses to achieve local privilege escalation on vulnerable Ubuntu kernels.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel 4.4.0 before 4.4.0-53.74 (Ubuntu 14.04 / 16.04)
No auth needed
Prerequisites: Vulnerable Linux kernel version · Local user access
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 13 stars
by martinmullins · poc
https://github.com/martinmullins/CVE-2016-8655_Android

This repository contains a functional exploit for CVE-2016-8655, targeting the Goldfish Android emulator. The exploit leverages a race condition to achieve local privilege escalation (LPE) by manipulating kernel memory structures.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Android Goldfish Emulator (3.4)
No auth needed
Prerequisites: Access to the Goldfish emulator environment · Kernel memory manipulation capabilities
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 5 stars
by LakshmiDesai · poc
https://github.com/LakshmiDesai/CVE-2016-8655

This repository contains a functional exploit for CVE-2016-8655, a race condition vulnerability in the Linux kernel's AF_PACKET implementation. The exploit leverages a race condition to achieve local privilege escalation (LPE) on vulnerable Ubuntu systems running kernel versions 4.4.0-51 and earlier.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (Ubuntu 16.04/14.04 with kernel versions 4.4.0-51 and earlier)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · GCC compiler to build the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by KosukeShimofuji · poc
https://github.com/KosukeShimofuji/CVE-2016-8655

The repository contains Ansible playbooks for system configuration and user setup but lacks any exploit code or technical details related to CVE-2016-8655. It appears to be a placeholder or mislabeled repository.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: N/A
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by agkunkle · poc
https://github.com/agkunkle/chocobo

This repository provides an analysis of CVE-2016-8655, a Linux privilege escalation vulnerability. It includes references, goals for deeper analysis, and instructions for debugging the kernel using QEMU and symbols.

Classification
Writeup 80%
Attack Type
Lpe
Complexity
Moderate
Reliability
Theoretical
Target: Linux Kernel
No auth needed
Prerequisites: Access to a vulnerable Linux system · Debugging tools like QEMU
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by scarvell · poc
https://github.com/scarvell/cve-2016-8655

The repository contains functional exploit code for CVE-2016-8655, a race condition in the Linux kernel's AF_PACKET implementation. The PoC leverages a race between setting socket options to trigger a use-after-free, potentially leading to privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions affected by CVE-2016-8655)
No auth needed
Prerequisites: Linux system with vulnerable kernel · Ability to create AF_PACKET sockets
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC GOOD
by rebel, bcoles · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/af_packet_chocobo_root_priv_esc.rb

This Metasploit module exploits a race condition and use-after-free vulnerability in the AF_PACKET implementation of the Linux kernel (CVE-2016-8655) to achieve local privilege escalation to root. It includes bypasses for SMEP and KASLR, and targets Ubuntu-based systems with specific kernel versions.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel versions 4.4.0 < 4.4.0-53.74 (Ubuntu Trusty/Xenial and derivatives)
No auth needed
Prerequisites: Unprivileged user namespaces enabled · Two or more CPU cores · SMAP disabled · Vulnerable kernel version
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (34)

Core 34
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3151-3
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00044.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00077.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00067.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3150-2
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3149-2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94692
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037968
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3150-1
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00056.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00073.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2017-0402.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3151-1
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2017-0387.html
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40871/
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3149-1
Issue Tracking, Third Party Advisory, VDB Entry x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1400019
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44696/
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00087.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3151-2
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00070.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/12/06/1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3152-1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3152-2
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2017-0386.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037403
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3151-4
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00055.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00054.html
Third Party Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2017-03-01.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00076.html

Scores

CVSS v3 7.8
EPSS 0.4799
EPSS Percentile 97.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-362 CWE-416
Status published
Products (5)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 16.10
linux/linux_kernel 3.2 - 3.2.85
Published Dec 08, 2016
Tracked Since Feb 18, 2026