Sploitus

Exploit for Linux kernel futex_requeue privilege elevation

saint Β· 2014-12-03

Exploit Code

MARKDOWN31 lines
## https://sploitus.com/exploit?id=SAINT:62CFE302E8E036752E595883D6BF6332
Added: 12/03/2014  
CVE: [CVE-2014-3153](<https://vulners.com/cve/CVE-2014-3153>)  
BID: [67906](<http://www.securityfocus.com/bid/67906>)  
OSVDB: [107752](<http://www.osvdb.org/107752>)  


### Background

The futex system call in Linux provides a mechanism for user-space locking. 

### Problem

A vulnerability in the Linux kernel allows an unprivileged user to gain root access using a specially crafted `**futex_requeue**` call. 

### Resolution

Upgrade to a fixed kernel package from your Linux vendor. 

### References

<https://lists.debian.org/debian-security-announce/2014/msg00130.html>  


### Limitations

Exploit works on CentOS 7 and Red Hat 7 and requires an existing unprivileged shell connection to the target. 

### Platforms

Linux