Exploitation Summary
EIP tracks 2 public exploits for CVE-2017-16939. PoCs published by SecuriTeam, TamiiLambrado.
AI-analyzed exploit summary This PoC exploits a use-after-free vulnerability in the Linux kernel's Netlink socket subsystem (XFRM) to achieve privilege escalation. It manipulates socket buffer sizes to trigger a race condition, leading to a potential read/write primitive.
Description
The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.
Exploits (2)
This PoC exploits a use-after-free vulnerability in the Linux kernel's Netlink socket subsystem (XFRM) to achieve privilege escalation. It manipulates socket buffer sizes to trigger a race condition, leading to a potential read/write primitive.
This PoC exploits a memory corruption vulnerability in the Linux Kernel's XFRM subsystem (CVE-2017-16939) by manipulating the sk_rcvbuf value via setsockopt and triggering a race condition in netlink_dump, leading to potential privilege escalation.
References (14)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H