Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2017-7184

Description

The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.

POC

Reference

- https://blog.trendmicro.com/results-pwn2own-2017-day-one/

Github

- https://github.com/ARPSyndicate/cvemon

- https://github.com/PuddinCat/GithubRepoSpider

- https://github.com/R0B1NL1N/linux-kernel-exploitation

- https://github.com/Technoashofficial/kernel-exploitation-linux

- https://github.com/b1nhack/CVE-2017-7184

- https://github.com/bsauce/kernel-security-learning

- https://github.com/kdn111/linux-kernel-exploitation

- https://github.com/khanhdn111/linux-kernel-exploitation

- https://github.com/khanhdz-06/linux-kernel-exploitation

- https://github.com/khanhdz191/linux-kernel-exploitation

- https://github.com/khanhhdz/linux-kernel-exploitation

- https://github.com/khanhhdz06/linux-kernel-exploitation

- https://github.com/khanhnd123/linux-kernel-exploitation

- https://github.com/khnhdz/linux-kernel-exploitation

- https://github.com/knd06/linux-kernel-exploitation

- https://github.com/mudongliang/LinuxFlaw

- https://github.com/ndk06/linux-kernel-exploitation

- https://github.com/ndk191/linux-kernel-exploitation

- https://github.com/oneoy/cve-

- https://github.com/ostrichxyz7/kexps

- https://github.com/purplewall1206/PET

- https://github.com/ret2p4nda/kernel-pwn

- https://github.com/skbasava/Linux-Kernel-exploit

- https://github.com/snorez/blog

- https://github.com/snorez/exploits

- https://github.com/ssr-111/linux-kernel-exploitation

- https://github.com/wkhnh06/linux-kernel-exploitation

- https://github.com/xairy/linux-kernel-exploitation

- https://github.com/xyongcn/exploit