CVE-2017-1000112
HIGHLinux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation
Title source: metasploitExploitation Summary
EIP tracks 9 public exploits for CVE-2017-1000112.
PoCs published by Metasploit, Andrey Konovalov, bcoles, including Metasploit module exploits/linux/local/ufo_privilege_escalation.
AI-analyzed exploit summary This Metasploit module exploits CVE-2017-1000112, a Linux kernel vulnerability in UDP Fragmentation Offload (UFO) to achieve local privilege escalation. It targets specific Ubuntu and Linux Mint kernels, requires unprivileged user namespaces and disabled SMAP, and includes bypasses for SMEP and KASLR.
Description
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.
Exploits (9)
This Metasploit module exploits CVE-2017-1000112, a Linux kernel vulnerability in UDP Fragmentation Offload (UFO) to achieve local privilege escalation. It targets specific Ubuntu and Linux Mint kernels, requires unprivileged user namespaces and disabled SMAP, and includes bypasses for SMEP and KASLR.
This is a local privilege escalation exploit for CVE-2017-1000112, targeting Ubuntu kernels 4.4.0-* and 4.8.0-*. It bypasses KASLR and SMEP to achieve root access by leveraging a race condition in the netfilter subsystem.
This is a local privilege escalation exploit for CVE-2017-1000112, targeting Ubuntu and Linux Mint kernels (4.4.0 and 4.8.0). It bypasses KASLR and SMEP to achieve root access by leveraging a race condition in the n_hdlc Linux kernel driver.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2017-1000112, targeting a vulnerability in the UFO Linux kernel implementation. The exploit includes KASLR and SMEP bypasses and has been tested on specific Ubuntu kernel versions.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2017-1000112, targeting a buffer overflow in the Linux kernel's UDP Fragmentation Offload (UFO) feature. The exploit includes KASLR and SMEP bypass techniques, and is tailored for specific Ubuntu kernel versions (e.g., 4.8.0-22-generic).
This repository contains a functional exploit for CVE-2017-1000112, a local privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the n_hdlc driver to achieve arbitrary code execution in kernel mode, bypassing KASLR and SMEP protections.
This repository contains a functional local privilege escalation (LPE) exploit for CVE-2017-1000112, targeting Ubuntu kernels 4.4.0-* and 4.8.0-*. The exploit includes KASLR and SMEP bypasses, demonstrating a reliable path to root access via crafted payload execution.
This repository contains a functional exploit for CVE-2017-1000112, demonstrating Docker container escape via kernel vulnerabilities. It includes components for privilege escalation, capability manipulation, and mitigation bypasses (KASLR, SMEP).
This Metasploit module exploits CVE-2017-1000112, a Linux kernel vulnerability in UDP Fragmentation Offload (UFO) to achieve local privilege escalation. It targets specific Ubuntu and Linux Mint kernels with unprivileged user namespaces enabled and SMAP disabled.
References (13)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H