cve/2017/CVE-2017-7184.md

CVE-2017-7184

Description

The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52.

POC

Reference

• https://blog.trendmicro.com/results-pwn2own-2017-day-one/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/R0B1NL1N/linux-kernel-exploitation
• https://github.com/Technoashofficial/kernel-exploitation-linux
• https://github.com/bsauce/kernel-security-learning
• https://github.com/kdn111/linux-kernel-exploitation
• https://github.com/khanhdn111/linux-kernel-exploitation
• https://github.com/khanhdz-06/linux-kernel-exploitation
• https://github.com/khanhdz191/linux-kernel-exploitation
• https://github.com/khanhhdz/linux-kernel-exploitation
• https://github.com/khanhhdz06/linux-kernel-exploitation
• https://github.com/khanhnd123/linux-kernel-exploitation
• https://github.com/knd06/linux-kernel-exploitation
• https://github.com/mudongliang/LinuxFlaw
• https://github.com/ndk06/linux-kernel-exploitation
• https://github.com/ndk191/linux-kernel-exploitation
• https://github.com/oneoy/cve-
• https://github.com/ostrichxyz7/kexps
• https://github.com/purplewall1206/PET
• https://github.com/ret2p4nda/kernel-pwn
• https://github.com/skbasava/Linux-Kernel-exploit
• https://github.com/snorez/blog
• https://github.com/snorez/exploits
• https://github.com/ssr-111/linux-kernel-exploitation
• https://github.com/wkhnh06/linux-kernel-exploitation
• https://github.com/xairy/linux-kernel-exploitation
• https://github.com/xyongcn/exploit