Exploit for Race Condition in Linux Linux Kernel

CVE-2017-1000405

githubexploit · 2017-11-29

Description

POC for a Linux kernel race condition vulnerability CVE-2017-1000405.

Entry point

Parameter/proc/self/mem · path

Path/proc/self/mem

Kernel memory access via /proc/self/mem used to overwrite huge zero page through THP and pmd dirtiness (CVE-2017-1000405).

Affected Linux Linux Kernel versions

Linux Linux Kernel< 3.3, 3.11, 3.13, 3.16.52, 3.18.86, 4.1.48, 4.4.104, 4.9.67, 4.14.4

All known vulnerabilities by product

Alt Linux Linux Kernel Suse Ubuntu

CVSS 7.0 for CVE-2017-1000405

7.0

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector:LOCAL

Attack Complexity:HIGH

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

75%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

2.8%higher than 84.8% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2025-04-10 15:54

Last Seen:2025-08-31 23:22

Reporter:bindecy

Written in:C

Last commit:2017-11-30

Tags

linux kernelrace conditionhuge dirty cow

Other exploits for CVE-2017-1000405

Exploit for Out-of-bounds Write in Linux Linux_Kernel

2025-09-13 mirrors_ljvblfzGITEE

Exploit for Race Condition in Linux Linux_Kernel

2021-05-30 chaojianhuGITEE

Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zero Page (2)

2017-12-11 anonymousEXPLOITDBC

Exploit for Race Condition in Linux Linux_Kernel

2017-12-04 feiserGITEE

Linux Kernel - The Huge Dirty Cow Overwriting The Huge Zero Page Exploit

2017-12-01 BindecyZDTC

Linux Kernel - The Huge Dirty Cow Overwriting The Huge Zero Page (1)

2017-11-30 BindecyEXPLOITPACKC

Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zero Page (1)

2017-11-30 BindecyEXPLOITDBC

"Huge Dirty COW" (CVE-2017–1000405)

2017-11-30 RootSEEBUGC

Exploit Code

README9 lines

## https://sploitus.com/exploit?id=51239CD5-F15B-57FD-A10E-3B98AD0313FA
# "Huge Dirty Cow" POC

A POC for the Huge Dirty Cow vulnerability (CVE-2017-1000405). Full details can be found [here](https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0).

Before running, make sure to set transparent huge pages to "always":
```
echo always | sudo tee /sys/kernel/mm/transparent_hugepage/enabled
```