Exploit for Race Condition in Linux Linux Kernel

CVE-2017-1000405

gitee · 2021-05-30

Description

Describes a use-after-free race in Linux kernel huge pages enabling arbitrary memory access.

Entry point

Parameter/proc/self/mem · path

Path/proc/self/mem

Kernel memory access via /proc/self/mem used to overwrite huge zero page through THP and pmd dirtiness (CVE-2017-1000405).

Affected Linux Linux Kernel versions

Linux Linux Kernel< 3.3, 3.11, 3.13, 3.16.52, 3.18.86, 4.1.48, 4.4.104, 4.9.67, 4.14.4

All known vulnerabilities by product

Alt Linux Linux Kernel Suse Ubuntu

CVSS 7.0 for CVE-2017-1000405

7.0

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector:LOCAL

Attack Complexity:HIGH

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

75%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

2.8%higher than 84.8% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2021-05-30 09:58

Last Seen:2025-09-11 21:01

Reporter:chaojianhu

Tags

use-after-freerace conditionlinux kernelhuge pagesarbitrary memory accessprivilege escalation

Other exploits for CVE-2017-1000405

Exploit for Out-of-bounds Write in Linux Linux_Kernel

2025-09-13 mirrors_ljvblfzGITEE

Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zero Page (2)

2017-12-11 anonymousEXPLOITDBC

Exploit for Race Condition in Linux Linux_Kernel

2017-12-04 feiserGITEE

Linux Kernel - The Huge Dirty Cow Overwriting The Huge Zero Page Exploit

2017-12-01 BindecyZDTC

Linux Kernel - The Huge Dirty Cow Overwriting The Huge Zero Page (1)

2017-11-30 BindecyEXPLOITPACKC

Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zero Page (1)

2017-11-30 BindecyEXPLOITDBC

"Huge Dirty COW" (CVE-2017–1000405)

2017-11-30 RootSEEBUGC

Exploit for Race Condition in Linux Linux_Kernel

2017-11-29 bindecyGITHUB

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=8B23C566-3343-53C8-9F0D-F8A7452E1104
PoC exploit for CVE-2017-1000405, a Linux kernel vulnerability known as Huge Dirty Cow. The target is the Linux kernel, specifically the huge page handling mechanism. The vulnerability class is a use-after-free bug in the huge page handling code, allowing for arbitrary memory access. The probable entry point is the main.c file, which is compiled with the gcc -pthread flag. Not specified how it is typically invoked. Preconditions include a vulnerable Linux kernel version and the transparent huge pages set to "always". Expected impact is arbitrary memory access and potential privilege escalation.