CVE-2017-0358
HIGHDebian/Ubuntu ntfs-3g Local Privilege Escalation
Title source: metasploitExploitation Summary
EIP tracks 4 public exploits for CVE-2017-0358.
PoCs published by Google Security Research, Kristian Erik Hermansen, Wangsafz, including Metasploit module exploits/linux/local/ntfs3g_priv_esc.
AI-analyzed exploit summary This exploit leverages a vulnerability in ntfs-3g's setuid binary to execute modprobe with attacker-controlled environment variables, leading to arbitrary kernel module loading and local privilege escalation. The exploit works by exhausting file descriptors to trigger a fallback to modprobe execution.
Description
Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation.
Exploits (4)
This exploit leverages a vulnerability in ntfs-3g's setuid binary to execute modprobe with attacker-controlled environment variables, leading to arbitrary kernel module loading and local privilege escalation. The exploit works by exhausting file descriptors to trigger a fallback to modprobe execution.
This exploit leverages CVE-2017-0358 to achieve local privilege escalation (LPE) by exploiting a vulnerability in ntfs-3g. It creates a malicious kernel module that, when loaded, spawns a root shell and copies a setuid shell to /tmp/r00t.
This repository contains a functional exploit for CVE-2017-0358, a local privilege escalation vulnerability in ntfs-3g. The exploit leverages a kernel module to escalate privileges to root by manipulating symlinks and executing a shell with elevated permissions.
This Metasploit module exploits CVE-2017-0358, a local privilege escalation vulnerability in ntfs-3g on Debian/Ubuntu systems. It abuses improper environment sanitization in the mount helper to load a malicious kernel module, granting root privileges.
References (7)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H