module

Linux BPF Sign Extension Local Privilege Escalation

Try Surface Command
Back to search
Disclosed
2017-11-12
Created
2018-07-25

Description

Linux kernel prior to 4.14.8 contains a vulnerability in the Berkeley
Packet Filter (BPF) verifier. The `check_alu_op` function performs
incorrect sign extension which allows the verifier to be bypassed,
leading to arbitrary kernel read/write.

The target system must be compiled with BPF support and permit
unprivileged access to BPF with `kernel.unprivileged_bpf_disabled`
not set to 1.

This module has been tested successfully on:

Debian 9.0 kernel 4.9.0-3-amd64;
Deepin 15.5 kernel 4.9.0-deepin13-amd64;
ElementaryOS 0.4.1 kernel 4.8.0-52-generic;
Fedora 24 kernel 4.5.5-300.fc24.x86_64;
Fedora 25 kernel 4.8.6-300.fc25.x86_64;
Fedora 26 kernel 4.11.8-300.fc26.x86_64;
Fedora 27 kernel 4.13.9-300.fc27.x86_64;
Gentoo 2.2 kernel 4.5.2-aufs-r;
Linux Mint 17.3 kernel 4.4.0-89-generic;
Linux Mint 18.0 kernel 4.8.0-58-generic;
Linux Mint 18.3 kernel 4.13.0-16-generic;
Mageia 6 kernel 4.9.35-desktop-1.mga6;
Manjero 16.10 kernel 4.4.28-2-MANJARO;
Solus 3 kernel 4.12.7-11.current;
Ubuntu 14.04.1 kernel 4.4.0-89-generic;
Ubuntu 16.04.2 kernel 4.8.0-45-generic;
Ubuntu 16.04.3 kernel 4.10.0-28-generic;
Ubuntu 17.04 kernel 4.10.0-19-generic;
ZorinOS 12.1 kernel 4.8.0-39-generic.

Authors

Jann Horn
bleidl
vnik
rlarabee
h00die
bcoles bcoles@gmail.com

Platform

Linux

Architectures

x86, x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/linux/local/bpf_sign_extension_priv_esc
    msf exploit(bpf_sign_extension_priv_esc) > show targets
        ...targets...
    msf exploit(bpf_sign_extension_priv_esc) > set TARGET < target-id >
    msf exploit(bpf_sign_extension_priv_esc) > show options
        ...show and set options...
    msf exploit(bpf_sign_extension_priv_esc) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today