CVE-2016-9793
HIGHLinux Kernel 3.5-3.12.69 - Memory Corruption via Negative sk_sndbuf/sk_rcvbuf Values
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2016-9793. PoCs published by Andrey Konovalov, codecat007, WhatsWrongAndWhy.
AI-analyzed exploit summary This exploit leverages a race condition in the Linux kernel (CVE-2016-9793) to achieve local privilege escalation (LPE) by manipulating socket buffers and overwriting kernel memory to execute arbitrary code with root privileges.
Description
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option.
Exploits (3)
This exploit leverages a race condition in the Linux kernel (CVE-2016-9793) to achieve local privilege escalation (LPE) by manipulating socket buffers and overwriting kernel memory to execute arbitrary code with root privileges.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2016-9793, which abuses the SO_SNDBUFFORCE and SO_RCVBUFFORCE socket options to achieve root privileges. The exploit manipulates kernel memory structures to overwrite critical data and escalate privileges.
This repository contains a Linux kernel exploit for CVE-2016-9793, a race condition in the `setsockopt()` system call that allows local privilege escalation (LPE) by manipulating the `sk_sndbuf` value of a socket. The exploit uses `mmap` and `pthread_create` to trigger the race condition and overwrite kernel memory.
References (12)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H