CVE-2014-3153 PoC — Linux kernel 提权漏洞

Source

https://github.com/lieanu/CVE-2014-3153

Associated Vulnerability

Title:Linux kernel 提权漏洞 (CVE-2014-3153)
Description:Linux kernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。NFSv4 implementation是其中的一个分布式文件系统协议。 Linux kernel 3.14.5及之前版本的kernel/futex.c文件中的‘futex_requeue’函数存在安全漏洞，该漏洞源于程序没有正确处理futex系统调用。本地攻击者可借助特制的FUTEX_REQUEUE命令利用该漏洞获取特权。

Description

cve2014-3153 exploit for ubuntu x86

Readme

##Towelroot for Ubuntu x86

This exp has been tested on ubuntu 14.04 x86 and ubuntu 12.04.2 x86 successfully.

Learning CVE2014-3153 and towelroot.

Kernel through version 3.14, use `rbtree` to store rt_waiter(not `plist_node`), more complex! 

IA have diffrent thread_info with ARM!!

![](./final.png)

Source from geekben/towelroot and timwr/CVE-2014-3153

###Compile and run

```
$ gcc -fno-stack-protector -m32 -O0 -pthread mytowel.c -o mytowel
or simply
$ gcc -pthread mytowel.c -o mytowel
$ ./mytowel
```

File Snapshot


 [4.0K]  /data/pocs/bd95da70387cb77e82dda9570137229e60ff1ef8
├── [777K]  cve2014-3153-ppt.pdf
├── [ 16K]  final.png
├── [ 20K]  mytowel.c
└── [ 511]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!