CVE-2016-9793
HIGHLinux Kernel 3.5-3.12.69 - Memory Corruption via Negative sk_sndbuf/sk_rcvbuf Values
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2016-9793. PoCs published by Andrey Konovalov, codecat007.
AI-analyzed exploit summary This exploit leverages a race condition in the Linux kernel (CVE-2016-9793) to achieve local privilege escalation (LPE) by manipulating socket buffers and overwriting kernel memory to execute arbitrary code with root privileges.
Description
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option.
Exploits (2)
This exploit leverages a race condition in the Linux kernel (CVE-2016-9793) to achieve local privilege escalation (LPE) by manipulating socket buffers and overwriting kernel memory to execute arbitrary code with root privileges.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2016-9793, which abuses the SO_SNDBUFFORCE and SO_RCVBUFFORCE socket options to achieve root privileges. The exploit manipulates kernel memory structures to overwrite critical data and escalate privileges.
References (12)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H