Privilege escalation in Linux kernel - CVE-2017-5123
Published: October 14, 2017 / Updated: August 23, 2023
Vulnerability identifier: #VU8828
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5123
CWE-ID: CWE-391
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 does not check that the incoming argument points to the userspace. This can allow local users to write directly to kernel memory, which could lead to privilege escalation.
The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 does not check that the incoming argument points to the userspace. This can allow local users to write directly to kernel memory, which could lead to privilege escalation.
Affected software
Linux kernel
Arch Linux
Fedora
kernel
Arch Linux
Fedora
kernel
How to mitigate CVE-2017-5123
Install update from vendor's repository.
kernel - addressed in versions 4.13.8-100.fc25, 4.13.8-200.fc26, 4.13.8-300.fc27
Links to Public Exploits and PoC-codes
- Exploit #9256 - kernel-POCs (A list of kernel exploits / CVE POCs) (August 23, 2023)
- Exploit #3499 - CVE-2017-5123 (PoC CVE-2017-5123 - LPE - Bypassing SMEP/SMAP. No KASLR) (July 15, 2020)
- Exploit #2386 - CVE-Exploit-Script () (April 7, 2020)
- Exploit #2335 - exploiting-cve-2017-5123 (Source code and configuration files related to our article in MISC96) (April 7, 2020)
- Exploit #165 - CVE-2017-5123 (linux kernel exploit ) (March 18, 2020)
- Exploit #166 - CVE-2017-5123 (Exploit for the linux kernel vulnerability CVE-2017-5123) (March 18, 2020)
- Exploit #1355 - Linux Kernel 4.13 (Ubuntu 17.10) - 'waitid()' SMEP/SMAP Privilege Escalation (March 18, 2020)
- Exploit #1356 - Linux Kernel 4.14.0-rc4+ - 'waitid()' Privilege Escalation (March 18, 2020)