diff --git a/db/modules_metadata_base.json b/db/modules_metadata_base.json index ac8a75d1b5..61f9dd0479 100644 --- a/db/modules_metadata_base.json +++ b/db/modules_metadata_base.json @@ -32655,6 +32655,53 @@ "is_install_path": true, "ref_name": "linux/local/bpf_priv_esc" }, + "exploit_linux/local/bpf_sign_extension_priv_esc": { + "name": "Linux BPF Sign Extension Local Privilege Escalation", + "full_name": "exploit/linux/local/bpf_sign_extension_priv_esc", + "rank": 500, + "disclosure_date": "2017-11-12", + "type": "exploit", + "author": [ + "Jann Horn", + "bleidl", + "vnik", + "rlarabee", + "h00die", + "bcoles" + ], + "description": "Linux kernel prior to 4.14.8 utilizes the Berkeley Packet Filter (BPF)\n which contains a vulnerability where it may improperly perform sign\n extension. This can be utilized to escalate privileges.\n\n The target system must be compiled with BPF support and must not have\n kernel.unprivileged_bpf_disabled set to 1.\n\n This module has been tested successfully on:\n\n Debian 9.0 kernel 4.9.0-3-amd64;\n Deepin 15.5 kernel 4.9.0-deepin13-amd64;\n ElementaryOS 0.4.1 kernel 4.8.0-52-generic;\n Fedora 25 kernel 4.8.6-300.fc25.x86_64;\n Fedora 26 kernel 4.11.8-300.fc26.x86_64;\n Fedora 27 kernel 4.13.9-300.fc27.x86_64;\n Gentoo 2.2 kernel 4.5.2-aufs-r;\n Linux Mint 17.3 kernel 4.4.0-89-generic;\n Linux Mint 18.0 kernel 4.8.0-58-generic;\n Linux Mint 18.3 kernel 4.13.0-16-generic;\n Mageia 6 kernel 4.9.35-desktop-1.mga6;\n Manjero 16.10 kernel 4.4.28-2-MANJARO;\n Solus 3 kernel 4.12.7-11.current;\n Ubuntu 14.04.1 kernel 4.4.0-89-generic;\n Ubuntu 16.04.2 kernel 4.8.0-45-generic;\n Ubuntu 16.04.3 kernel 4.10.0-28-generic;\n Ubuntu 17.04 kernel 4.10.0-19-generic;\n ZorinOS 12.1 kernel 4.8.0-39-generic.", + "references": [ + "AKA-get-rekt-linux-hardened.c", + "AKA-upstream44.c", + "BID-102288", + "CVE-2017-16995", + "EDB-44298", + "EDB-45010", + "URL-https://github.com/rlarabee/exploits/blob/master/cve-2017-16995/cve-2017-16995.c", + "URL-https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c", + "URL-http://cyseclabs.com/pub/upstream44.c", + "URL-https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor", + "URL-https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html", + "URL-https://www.debian.org/security/2017/dsa-4073", + "URL-https://usn.ubuntu.com/3523-2/", + "URL-https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16995.html", + "URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1454", + "URL-http://openwall.com/lists/oss-security/2017/12/21/2", + "URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f" + ], + "is_server": true, + "is_client": false, + "platform": "Linux", + "arch": "x86, x64", + "rport": "", + "targets": [ + "Auto" + ], + "mod_time": "2018-07-17 06:24:16 +0000", + "path": "/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb", + "is_install_path": true, + "ref_name": "linux/local/bpf_sign_extension_priv_esc" + }, "exploit_linux/local/cron_persistence": { "name": "Cron Persistence", "full_name": "exploit/linux/local/cron_persistence",