Exploitation Summary
EIP tracks 3 public exploits for CVE-2018-5333.
PoCs published by TamiiLambrado, Mohamed Ghannam, Jann Horn, wbowling, bcoles, nstarke, including Metasploit module exploits/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc.
AI-analyzed exploit summary This PoC demonstrates a NULL pointer dereference vulnerability in the Linux kernel's RDS socket implementation (CVE-2018-5333). It exploits improper handling of ancillary data in the `rds_cmsg_atomic` function, leading to a crash when `rds_atomic_free_op` is called on an uninitialized scatterlist.
Description
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference.
Exploits (3)
This PoC demonstrates a NULL pointer dereference vulnerability in the Linux kernel's RDS socket implementation (CVE-2018-5333). It exploits improper handling of ancillary data in the `rds_cmsg_atomic` function, leading to a crash when `rds_atomic_free_op` is called on an uninitialized scatterlist.
This Metasploit module exploits a NULL pointer dereference in the `rds_atomic_free_op` function in the Linux kernel's RDS module (CVE-2018-5333) to achieve local privilege escalation. It combines this with a MAP_GROWSDOWN mmap_min_addr bypass (CVE-2019-9213) and includes KASLR/SMEP bypasses.
This Metasploit module exploits a NULL pointer dereference in the `rds_atomic_free_op` function in the Linux kernel's RDS module (CVE-2018-5333) to achieve local privilege escalation. It combines this with a MAP_GROWSDOWN mmap_min_addr bypass (CVE-2019-9213) and includes KASLR/SMEP bypasses.
References (15)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H