CVE-2017-5123

HIGH

Linux Kernel 4.13 through 4.13.7 - Sandbox Escape via waitid

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 13 public exploits for CVE-2017-5123. PoCs published by Chris Salls, @XeR_0x2A & @chaign_c, qazbnm456.

AI-analyzed exploit summary This exploit leverages CVE-2017-5123, a waitid bug in Linux Kernel 4.13, to bypass seccomp, chroot, and uid namespace restrictions, achieving root privileges. It involves kernel memory corruption, SMAP/SMEP bypass, and arbitrary read/write via physmap manipulation.

Description

Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.

Exploits (13)

exploitdb WORKING POC
by Chris Salls · clocallinux
https://www.exploit-db.com/exploits/43127

This exploit leverages CVE-2017-5123, a waitid bug in Linux Kernel 4.13, to bypass seccomp, chroot, and uid namespace restrictions, achieving root privileges. It involves kernel memory corruption, SMAP/SMEP bypass, and arbitrary read/write via physmap manipulation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux Kernel 4.13
No auth needed
Prerequisites: Linux Kernel 4.13 · Access to a sandboxed environment (e.g., Chrome's seccomp)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by @XeR_0x2A & @chaign_c · clocallinux
https://www.exploit-db.com/exploits/43029

This exploit leverages CVE-2027-5123, a Linux kernel vulnerability, to achieve local privilege escalation by manipulating memory mappings and kernel function pointers. It uses shellcode to overwrite kernel structures and gain root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux Kernel (specific version not specified)
No auth needed
Prerequisites: Access to a vulnerable Linux kernel · Ability to compile and execute C code
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WRITEUP 3,480 stars
by qazbnm456 · poc
https://github.com/qazbnm456/awesome-cve-poc/tree/master/CVE-2017-5123.md

This repository provides a detailed writeup and references for CVE-2017-5123, a Linux kernel vulnerability in the waitid() function that allows container escape. It includes links to external PoCs and technical analyses but does not contain direct exploit code.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel v4.13
No auth needed
Prerequisites: Access to a vulnerable Linux kernel version · Ability to execute code within a Docker container
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 32 stars
by c3r34lk1ll3r · poc
https://github.com/c3r34lk1ll3r/CVE-2017-5123

This repository contains a proof-of-concept exploit for CVE-2017-5123, a local privilege escalation vulnerability in the Linux kernel's waitid system call. The exploit bypasses SMEP/SMAP protections by leveraging an unrestricted write operation to kernel memory.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (versions with commit 4c48abe91be0)
Auth required
Prerequisites: Local access to a vulnerable Linux kernel · Kernel built with specific configuration (e.g., no KASLR)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WRITEUP 14 stars
by xbl3 · poc
https://github.com/xbl3/awesome-cve-poc_qazbnm456/tree/master/CVE-2017-5123.md

This repository provides a detailed writeup and references for CVE-2017-5123, a Linux kernel vulnerability in the waitid() function that allows local privilege escalation. It includes links to external PoCs and technical analyses but does not contain exploit code itself.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel v4.13
No auth needed
Prerequisites: Local access to a vulnerable system
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 5 stars
by 0x5068656e6f6c · poc
https://github.com/0x5068656e6f6c/CVE-2017-5123

This is a local privilege escalation exploit for CVE-2017-5123, targeting a kernel vulnerability in Linux. It leverages a race condition in the waitid system call to overwrite kernel memory and execute a shellcode payload to gain root privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux Kernel (versions affected by CVE-2017-5123)
No auth needed
Prerequisites: Linux system with vulnerable kernel · Ability to compile and execute C code · No SMEP/SMAP or kptr_restrict protections
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 4 stars
by Synacktiv-contrib · poc
https://github.com/Synacktiv-contrib/exploiting-cve-2017-5123

This repository contains a working privilege escalation exploit for CVE-2017-5123, targeting a Linux kernel vulnerability. The exploit uses memory probing and heap spraying to achieve root privileges, though it may leave the system unstable.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (version ff33952e4d23)
No auth needed
Prerequisites: Vulnerable Linux kernel version · QEMU environment with specific configurations · SMEP/SMAP and KASLR enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC 2 stars
by dark-vex · pythonpoc
https://github.com/dark-vex/CVE-PoC-collection/tree/master/CVE-2017-5123

This repository contains a functional privilege escalation exploit for CVE-2017-5123, leveraging a null pointer dereference in the `waitid` syscall to achieve arbitrary kernel memory write and escalate privileges. The exploit includes a detailed technical explanation, compilation instructions, and a working PoC in C.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel versions 4.13 to 4.14.0-rc4+
No auth needed
Prerequisites: Linux kernel with the vulnerability (4.13 to 4.14.0-rc4+) · Ability to compile and run the exploit on the target system · Disable KASLR (nokaslr) for reliable exploitation
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 1 stars
by FloatingGuy · poc
https://github.com/FloatingGuy/CVE-2017-5123

This repository contains a proof-of-concept exploit for CVE-2017-5123, a Linux kernel privilege escalation vulnerability in the `waitid` syscall. The exploit leverages an arbitrary write primitive to overwrite kernel memory, specifically targeting the `have_canfork_callback` variable to achieve privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel versions 4.13 to 4.14.0-rc4+
No auth needed
Prerequisites: Local access to a vulnerable Linux kernel · Kernel memory write permissions via `waitid` syscall
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by NabilBoudra · poc
https://github.com/NabilBoudra/cve-2017-5123

This repository contains a proof-of-concept exploit for CVE-2017-5123, a Linux kernel vulnerability allowing local privilege escalation, along with a kernel rootkit implementing an ICMP-based command-and-control channel and a vulnerable web application demonstrating OS command injection.

Classification
Working Poc 95%
Attack Type
Lpe | Rce
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel 4.13 up to (but excluding) 4.13.7
No auth needed
Prerequisites: Linux Kernel 4.13 up to (but excluding) 4.13.7 · Node.js 10.x · npm 6.x
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by ahiahai242 · poc
https://github.com/ahiahai242/CVE-2017-5123

The repository contains functional exploit code for CVE-2017-5123, a Linux kernel vulnerability in the waitid system call that allows local privilege escalation due to missing address validation. The PoC includes both a full exploit and a minimal version demonstrating the KASLR bypass and memory corruption techniques.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux Kernel (versions affected by CVE-2017-5123)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Kernel version without the patch for CVE-2017-5123
devstral-2 · analyzed Jun 16, 2026 Full analysis →
nomisec WORKING POC
by h1bAna · poc
https://github.com/h1bAna/CVE-2017-5123

This repository contains a working proof-of-concept exploit for CVE-2017-5123, a Linux kernel vulnerability in the waitid system call that allows local privilege escalation by writing to kernel memory due to missing access_ok() checks.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (versions affected by CVE-2017-5123)
No auth needed
Prerequisites: Local access to the vulnerable system · Kernel version vulnerable to CVE-2017-5123
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by teawater · poc
https://github.com/teawater/CVE-2017-5123

This is a working privilege escalation exploit for CVE-2017-5123, leveraging a vulnerability in the waitid system call to overwrite kernel memory and gain root privileges. The exploit manipulates kernel structures to escalate privileges and obtain root filesystem access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel 4.13.0
No auth needed
Prerequisites: Linux kernel 4.13.0 with specific configurations · Kernel addresses for key structures · nosmep kernel command line option
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
https://crbug.com/772848
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20211223-0003/

Scores

CVSS v3 8.8
EPSS 0.0371
EPSS Percentile 88.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (9)
linux/linux_kernel 4.13 - 4.13.7
netapp/cloud_backup
netapp/h300e_firmware
netapp/h300s_firmware
netapp/h410s_firmware
netapp/h500e_firmware
netapp/h500s_firmware
netapp/h700e_firmware
netapp/h700s_firmware
Published Nov 02, 2021
Tracked Since Feb 18, 2026