high8.8Public exploit code
CVE-2017-5123
Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Linux Kernel 4.13 (Ubuntu 17.10) - 'waitid()' SMEP/SMAP/Chrome Sandbox Privilege Escalation2017-11-06 · local · linux
- Linux Kernel 4.14.0-rc4+ - 'waitid()' Local Privilege Escalation2017-10-22 · local · linux
Impact
Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux Kernel | from 4.13 before 4.13.7 |
| Netapp | Cloud Backup | All versions |
| Netapp | H300s Firmware | All versions |
| Netapp | H500s Firmware | All versions |
| Netapp | H700s Firmware | All versions |
| Netapp | H300e Firmware | All versions |
| Netapp | H500e Firmware | All versions |
| Netapp | H700e Firmware | All versions |
| Netapp | H410s Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://crbug.com/772848
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=96ca579a1ecc943b75beba58bebb0356f6cc4b51
- https://security.netapp.com/advisory/ntap-20211223-0003/
- https://crbug.com/772848
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=96ca579a1ecc943b75beba58bebb0356f6cc4b51
- https://security.netapp.com/advisory/ntap-20211223-0003/