CVE-2017-16995
Description
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Linux - BPF Sign Extension Local Privilege Escalation (Metasploit)
Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation
Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation
Metasploit modules
OS impact
Linux kernel Affected 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Affected | 4.9.72 |
Ubuntu Affected 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 16.04 | Affected | — |
| 14.04 | Affected | — |
Debian Mixed 6 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 4.14.7-1 |
| sid | Fixed | 4.14.7-1 |
| forky | Fixed | 4.14.7-1 |
| bullseye | Fixed | 4.14.7-1 |
| bookworm | Fixed | 4.14.7-1 |
| 9.0 | Affected | — |
Arch Fixed 1 release
| Version | Status | Fixed in |
|---|---|---|
| — | Fixed | 4.14.11.a-1 |
References
- https://security.archlinux.org/ASA-201801-4
- https://security.archlinux.org/ASA-201801-3
- https://security.archlinux.org/ASA-201801-2
- https://security.archlinux.org/ASA-201801-1
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f
- http://openwall.com/lists/oss-security/2017/12/21/2
- http://www.securityfocus.com/bid/102288
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1454
- https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=a6132276ab5dcc38b3299082efeb25b948263adb
- https://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3633-1/
- https://usn.ubuntu.com/usn/usn-3523-2/
- https://www.debian.org/security/2017/dsa-4073
- https://www.exploit-db.com/exploits/44298/
- https://www.exploit-db.com/exploits/45010/
- https://www.exploit-db.com/exploits/45058/
- https://security-tracker.debian.org/tracker/CVE-2017-16995
CWEs
CWE-119
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.