Linux kernel: CVE-2017-1000112: a memory corruption due to UFO to non-UFO path switch
High
I
Internet Bug Bounty
Submitted None
Actions:
Reported by
xairy
Vulnerability Details
Technical details and impact analysis
Hi!
[CVE-2017-1000112](https://nvd.nist.gov/vuln/detail/CVE-2017-1000112) is a vulnerability I found in the Linux kernel caused by a UFO to non-UFO path switch for UFO packets. It can be exploited to gain kernel code execution from an unprivileged process.
This vulnerability was reported to [email protected] and linux-distros@ following the coordinated disclosure process and then [announced](https://www.openwall.com/lists/oss-security/2017/08/13/1) on oss-security@. The fix was [committed](https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa) on Aug 10, 2017.
I wrote a proof-of-concept exploit for a range of Ubuntu kernels Ubuntu kernel which gains root from an unprivileged user, which can be found [here](https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-1000112). More details about the vulnerability and exploitation can be found in the oss-security [announcement](https://www.openwall.com/lists/oss-security/2017/08/13/1).
The reason I'm reporting this now is that a [similar bug](https://hackerone.com/reports/347282) that I've reported a while ago has recently been triaged and addressed, so it seems that LPE Linux kernel bugs are within the scope of this IBB program.
Thanks!
## Impact
This vulnerability allows a local attacker to elevate privileges to root on a machine with vulnerable Linux kernel version.
Related CVEs
Associated Common Vulnerabilities and Exposures
CVE-2017-1000112
UNKNOWN
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO …
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Memory Corruption - Generic