CVE-2024-14027
ANALYSIS PENDINGLinux Kernel 6.11-6.12.76 - Unprivileged Local Denial of Service via fremovexattr Error Path File Reference Leak
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-14027. PoCs published by lcfr-eth.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2024-14027, a Linux kernel vulnerability in `fs/xattr.c` that allows local privilege escalation via a refcount overflow in `fremovexattr`. The exploits demonstrate leaking `/etc/shadow` and achieving a root shell through a double-close technique.
Description
In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when strncpy_from_user() fails on the name argument. In multi-threaded processes where fdget() takes the slow path, this permanently leaks one file reference per call, pinning the struct file and associated kernel objects in memory. An unprivileged local user can exploit this to cause kernel memory exhaustion. The issue was inadvertently fixed by commit a71874379ec8 ("xattr: switch to CLASS(fd)").
Exploits (1)
This repository contains functional exploit code for CVE-2024-14027, a Linux kernel vulnerability in `fs/xattr.c` that allows local privilege escalation via a refcount overflow in `fremovexattr`. The exploits demonstrate leaking `/etc/shadow` and achieving a root shell through a double-close technique.