Published: 05/10/2017 Updated: 07/06/2023

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

CVSS v3 Base Score: 7 | Impact Score: 5.9 | Exploitability Score: 1

VMScore: 711

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel

Debian Bug report logs - #875881 linux: CVE-2017-1000251 Package: src:linux; Maintainer for src:linux is Debian Kernel Team <debian-kernel@listsdebianorg>; Reported by: Christoph Anton Mitterer <calestyo@scientianet> Date: Fri, 15 Sep 2017 14:42:01 UTC Severity: critical Tags: confirmed, fixed-upstream, security, ...

Several vulnerabilities have been discovered in the Linux kernel that may lead to privilege escalation, denial of service or information leaks CVE-2017-7518 Andy Lutomirski discovered that KVM is prone to an incorrect debug exception (#DB) error occurring while emulating a syscall instruction A process inside a guest can take advanta ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise MRG 2Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVS ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 73 Advanced Update Support, Red Hat Enterprise Linux 73 Telco Extended Update Support, and Red Hat Enterprise Linux 73 Update Services ...

Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...

Synopsis Important: kernel security update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 59 Long LifeRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 5 Extended Lifecycle SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabil ...

Several security issues were fixed in the Linux kernel ...

Exploitable memory corruption due to UFO to non-UFO path switch (CVE-2017-1000112) heap out-of-bounds in AF_PACKET sockets (CVE-2017-1000111) The mq_notify function in the Linux kernel does not set the sock pointer to NULL upon entry into the retry logic During a user-space close of a Netlink socket, it allows attackers to possibly cause a situati ...

An exploitable memory corruption flaw was found in the Linux kernel The append path can be erroneously switched from UFO to non-UFO in ip_ufo_append_data() when building an UFO packet with MSG_MORE option If unprivileged user namespaces are available, this flaw can be exploited to gain root privileges ...

Exploitable memory corruption due to UFO to non-UFO path switch When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption In case UFO packet lengths exceeds MTU, copy = maxfraglen ...

This Metasploit module attempts to gain root privileges on Linux systems by abusing UDP Fragmentation Offload (UFO) This exploit targets only systems using Ubuntu (Trusty / Xenial) kernels 440-21 <= 440-89 and 480-34 <= 480-58, including Linux distros based on Ubuntu, such as Linux Mint The target system must have unprivileged user ...

// A proof-of-concept local root exploit for CVE-2017-1000112 // Includes KASLR and SMEP bypasses No SMAP bypass // Tested on Ubuntu trusty 440-* and Ubuntu xenial 4-8-0-* kernels // // EDB Note: Also included the work from ~ ricklarabeeblogspotcouk/2017/12/adapting-poc-for-cve-2017-1000112-tohtml // Supports: Ubuntu Xen ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = GoodRanking include Msf::Post::File include Msf::Post::Linux::Priv include Msf::Post::Linux::System include Msf::Post::Linux::Kernel include Ms ...

// A proof-of-concept local root exploit for CVE-2017-1000112 // Includes KASLR and SMEP bypasses No SMAP bypass // Tested on: // - Ubuntu trusty 440 kernels // - Ubuntu xenial 440 and 480 kernels // - Linux Mint rosa 440 kernels // - Linux Mint sarah 480 kernels // - Zorin OS 121 440-39 kernel // // Usage: // user@ubuntu:~$ uname - ...

Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities

KOOBE Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities Setup /setupsh /buildsh It's been tested on Ubuntu 1804 Usage source koobe/bin/activate cd aeg-analysis python mainpy -h Tutorial CVE-2017-7308 CVE-2018-5703 CVE-2017-7533 CVE-2017-1000112 Utilit

POE code for CVE-2017-1000112 adapted to both funtion on a specific VM and Escape a Docker

CVE-2017-1000112-Adpated POE code for CVE-2017-1000112 adapted to both funtion on a specific VM and Escape a Docker

LES: Linux privilege escalation auditing tool Quick download: wget rawgithubusercontentcom/mzet-/linux-exploit-suggester/master/linux-exploit-suggestersh -O lessh Details about LES usage and inner workings: mzet-githubio/2019/05/10/les-paperhtml Additional resources for the LE

LKRG bypass methods

lkrg-bypass The repository contains set of methods which I consider to be useful to test LKRG protection against exploitation The history of researching of such methods started a year back with my the very first comment to LKRG community of how I see the LKRG protection can be bypassed: wwwopenwallcom/lists/lkrg-users/2018/11/16/2 There were few more discussions la

Linux privilege escalation auditing tool

Exploit work Privilege Escalation CVE-2017-1000112

SNP-Assignment Exploit work Privilege Escalation CVE-2017-1000112 as the privilege escalation is the mile stone of an attakers view,i try to do a little research on loval privilege escalation which is the basic step of whole privilege escalation unit while im reading some articles 2016 and 2017 are the years with most no of privilege escalation reports on local and also remote

Escape from Docker using CVE-2017-1000112 and CVE-2017-18344, including gaining root privilage, get all capbilities, namespace recovery, filesystem recovery, cgroup limitation bypass and seccomp bypass.

Escape from Docker using CVE-2017-1000112 and CVE-2017-18344 Including: gaining root privilage get all capbilities namespace recovery filesystem recovery cgroup limitation bypass seccomp bypass

Linux privilege escalation auditing tool

LES: Linux privilege escalation auditing tool: Quick download: git clone githubcom/0dayhunter/Linux-exploit-suggestergit Purpose The LES tool is designed to assist in detecting security deficiencies for a given Linux kernel/Linux-based machine It provides the following functionality: Assessing kernel exposure on publicly known

Linux kernel < 4.10.15 - Race Condition Privilege Escalation

Ecploit-kernel-410-linux-local Linux kernel < 41015 - Race Condition Privilege Escalation Linux kernel < 41015 CVE-2017-1000112 This is a proof-of-concept local root exploit for the vulnerability in the UFO Linux kernel implementation CVE-2017-1000112 Some details: wwwopenwallcom/lists/oss-security/2017/08/13/1 s/timerfdc Vulnerbility Exploit Vulne

Lightning talk

Lightning talk Short presentation given at sthack and hacktivity about using CVE-2017-1000112 to escape docker & lxc

Don't be BlindSided: Watch speculative memory probing bypass kernel defenses, give malware root control

The Register • Thomas Claburn in San Francisco • 10 Sep 2020

Silently side-step software safeguards

Video Boffins in America, the Netherlands, and Switzerland have devised a Spectre-style attack on modern processors that can defeat defenses that are supposed to stop malicious software from hijacking a computer's operating system. The end result is exploit code able to bypass a crucial protection mechanism and take over a device to hand over root access. That's a lot to unpack so we'll start from the top. Let's say you find a security vulnerability, such as a buffer overflow, in the kernel of a...

CVE-2017-1000112

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect