CVE-2020-27786
HIGHLinux Kernel < 4.4.224 - Use-After-Free in MIDI ioctl Handler
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2020-27786. PoCs published by kiks7, ii4gsp, Trinadh465.
AI-analyzed exploit summary This is a working proof-of-concept exploit for CVE-2020-27786, a race condition vulnerability in the Linux kernel leading to a write Use-After-Free. The exploit uses userfaultfd to extend the race window and leverages msg_msg to leak kernel addresses and obtain a write primitive, ultimately overwriting modprobe_path to achieve privilege escalation.
Description
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Exploits (4)
This is a working proof-of-concept exploit for CVE-2020-27786, a race condition vulnerability in the Linux kernel leading to a write Use-After-Free. The exploit uses userfaultfd to extend the race window and leverages msg_msg to leak kernel addresses and obtain a write primitive, ultimately overwriting modprobe_path to achieve privilege escalation.
This exploit leverages a use-after-free vulnerability in the Linux kernel's ALSA rawmidi subsystem (CVE-2020-27786) to achieve local privilege escalation. It employs userfaultfd for memory manipulation and ROP to bypass KASLR and SMAP, ultimately executing a root shell.
The repository contains documentation files from a Linux kernel version 4.19.72, specifically focusing on ABI stability, admin guides, and hardware-specific documentation. No exploit code or proof-of-concept is present in the provided files.
The repository only contains a README.md with basic compilation instructions for a CMake project, lacking any actual exploit code or technical details about CVE-2020-27786.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H