module

Linux BPF doubleput UAF Privilege Escalation

Try Surface Command
Back to search
Disclosed
May 4, 2016
Created
May 30, 2018

Description

Linux kernel 4.4 does not properly reference count file descriptors, resulting
in a use-after-free, which can be abused to escalate privileges.

The target system must be compiled with `CONFIG_BPF_SYSCALL`
and must not have `kernel.unprivileged_bpf_disabled` set to 1.

Note, this module will overwrite the first few lines
of `/etc/crontab` with a new cron job. The job will
need to be manually removed.

This module has been tested successfully on Ubuntu 16.04 (x64)
kernel 4.4.0-21-generic (default kernel).

Authors

jannh [email protected]
h00die [email protected]

Platform

Linux

Architectures

x86, x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/linux/local/bpf_priv_esc
    msf exploit(bpf_priv_esc) > show targets
        ...targets...
    msf exploit(bpf_priv_esc) > set TARGET < target-id >
    msf exploit(bpf_priv_esc) > show options
        ...show and set options...
    msf exploit(bpf_priv_esc) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report