{"uuid": "ef959503-473a-4aa1-b8f1-807b64b92ea2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16995", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Jann Horn\", \"bleidl\", \"vnik\", \"rlarabee\", \"h00die\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"Linux kernel prior to 4.14.8 contains a vulnerability in the Berkeley\\n          Packet Filter (BPF) verifier. The `check_alu_op` function performs\\n          incorrect sign extension which allows the verifier to be bypassed,\\n          leading to arbitrary kernel read/write.\\n\\n          The target system must be compiled with BPF support and permit\\n          unprivileged access to BPF with `kernel.unprivileged_bpf_disabled`\\n          not set to 1.\\n\\n          This module has been tested successfully on:\\n\\n          Debian 9.0 kernel 4.9.0-3-amd64;\\n          Deepin 15.5 kernel 4.9.0-deepin13-amd64;\\n          ElementaryOS 0.4.1 kernel 4.8.0-52-generic;\\n          Fedora 24 kernel 4.5.5-300.fc24.x86_64;\\n          Fedora 25 kernel 4.8.6-300.fc25.x86_64;\\n          Fedora 26 kernel 4.11.8-300.fc26.x86_64;\\n          Fedora 27 kernel 4.13.9-300.fc27.x86_64;\\n          Gentoo 2.2 kernel 4.5.2-aufs-r;\\n          Linux Mint 17.3 kernel 4.4.0-89-generic;\\n          Linux Mint 18.0 kernel 4.8.0-58-generic;\\n          Linux Mint 18.3 kernel 4.13.0-16-generic;\\n          Mageia 6 kernel 4.9.35-desktop-1.mga6;\\n          Manjero 16.10 kernel 4.4.28-2-MANJARO;\\n          Solus 3 kernel 4.12.7-11.current;\\n          Ubuntu 14.04.1 kernel 4.4.0-89-generic;\\n          Ubuntu 16.04.2 kernel 4.8.0-45-generic;\\n          Ubuntu 16.04.3 kernel 4.10.0-28-generic;\\n          Ubuntu 17.04 kernel 4.10.0-19-generic;\\n          ZorinOS 12.1 kernel 4.8.0-39-generic.\", \"disclosure_date\": \"2017-11-12\", \"fullname\": \"exploit/linux/local/bpf_sign_extension_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-05-25 08:39:44 +0000\", \"name\": \"Linux BPF Sign Extension Local Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"get-rekt-linux-hardened.c\", \"upstream44.c\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"crash-os-down\"]}, \"path\": \"/modules/exploits/linux/local/bpf_sign_extension_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"linux/local/bpf_sign_extension_priv_esc\", \"references\": [\"BID-102288\", \"CVE-2017-16995\", \"EDB-44298\", \"EDB-45010\", \"URL-https://github.com/rlarabee/exploits/blob/master/cve-2017-16995/cve-2017-16995.c\", \"URL-https://github.com/brl/grlh/blob/master/get-rekt-linux-hardened.c\", \"URL-https://cyseclabs.com/exploits/upstream44.c\", \"URL-https://blog.aquasec.com/ebpf-vulnerability-cve-2017-16995-when-the-doorman-becomes-the-backdoor\", \"URL-https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html\", \"URL-https://www.debian.org/security/2017/dsa-4073\", \"URL-https://usn.ubuntu.com/3523-2/\", \"URL-https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16995.html\", \"URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1454\", \"URL-http://openwall.com/lists/oss-security/2017/12/21/2\", \"URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Auto\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:06.413309Z"}