This Metasploit module attempts to exploit CVE-2014-0038, by sending a recvmmsg system call with a crafted timeout pointer parameter to gain root. This exploit has offsets for 3 Ubuntu 13 kernels built in: 3.8.0-19-generic (13.04 default) 3.11.0-12-generic (13.10 default) 3.11.0-15-generic (13.10) This exploit may take up to 13 minutes to run due to a decrementing (1/sec) pointer which starts at 0xff*3 (765 seconds)
82b7ac9274ee1da7aa1283d1f828bf5efb5666ae8d5432aec64d8da96a714f43Slackware Security Advisory - New kernel packages are available for Slackware 14.1 (64-bit) to fix a security issue.
cc78a9497557a0501a4443b959c390cd7c60c4c627e19be5e2974d83af41c6bdMandriva Linux Security Advisory 2014-038 - Multiple vulnerabilities has been found and corrected in the Linux kernel. The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter. The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service or possibly gain privileges via a crafted application. The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call. The updated packages provides a solution for these security issues.
e2c4547e50770bd3df69abde587f4db32a1c9a1954a305f2d7cf5ee05330a99eLinux 3.4+ local root exploit that spawns a root shell leveraging CONFIG_X86_X32=y.
ede5fc0e0b7e794118d72948df2017010eaec9fd53af8390f4d8bde0ec184fa6Linux 3.4+ arbitrary write exploit for CONFIG_X86_X32 that spawns a root shell.
4fc904f1502158ecb8a6b7cfef323a01f7b9fb01f6ee00d06660c72f407ddd61Ubuntu Security Notice 2096-1 - Pageexec reported a bug in the Linux kernel's recvmsg syscall when called from code using the x32 ABI. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or gain administrator privileges.
3642a965005a189450ebb9a7da63b4405f4feb956e8633f63544fba0c47da057Ubuntu Security Notice 2095-1 - Pageexec reported a bug in the Linux kernel's recvmsg syscall when called from code using the x32 ABI. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or gain administrator privileges.
ca8a6e458cf823bb6dbd65dc2b895cf52f5e38bd8da50a892074bcbfa99a76b9Ubuntu Security Notice 2094-1 - Pageexec reported a bug in the Linux kernel's recvmsg syscall when called from code using the x32 ABI. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or gain administrator privileges.
faa4dd51c8b2fc6a08a0eacbf4b60dad67d7f8c44bca960b5e7b6ee945035133
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed