Metasploit Module: Linux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/ufo_privilege_escalation.rb
Disclosure date: 2017-08-10
References: CVE-2[PII_REDACTED], EDB-43418, BID-100262, URL-https://seclists.org/oss-sec/2017/q3/277, URL-https://github.com/xairy/kernel-exploits/blob/master/CVE-2[PII_REDACTED]/poc.c, URL-https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa, URL-https://people.canonical.com/~ubuntu-security/cve/CVE-2[PII_REDACTED], URL-https://securingtomorrow.mcafee.com/mcafee-labs/linux-kernel-vulnerability-can-lead-to-privilege-escalation-analyzing-cve-2[PII_REDACTED]/, URL-https://ricklarabee.blogspot.com/2017/12/adapting-poc-for-cve-2[PII_REDACTED]-to.html, URL-https://github.com/bcoles/kernel-exploits/commits/cve-2[PII_REDACTED]

Description:
This module attempts to gain root privileges on Linux systems by abusing
          UDP Fragmentation Offload (UFO).

          This exploit targets only systems using Ubuntu (Trusty / Xenial) kernels
          4.4.0-21 <= 4.4.0-89 and 4.8.0-34 <= 4.8.0-58, including Linux distros
          based on Ubuntu, such as Linux Mint.

          The target system must have unprivileged user namespaces enabled
          and SMAP disabled.

          Bypasses for SMEP and KASLR are included. Failed exploitation
          may crash the kernel.

          This module has been tested successfully on various Ubuntu and Linux
          Mint systems, including:

          Ubuntu 14.04.5 4.4.0-31-generic x64 Desktop;
          Ubuntu 16.04 4.8.0-53-generic;
          Linux Mint 17.3 4.4.0-89-generic;
          Linux Mint 18 4.8.0-58-generic

Check method (fingerprinting):
arch = kernel_hardware
    unless arch.include? 'x86_64'
      vprint_error "System architecture #{arch} is not supported"
      return CheckCode::Safe("System architecture #{arch} is not supported")
    end
    vprint_good "System architecture #{arch} is supported"

    version = kernel_release
    unless version =~ /^4\.4\.0-(21|22|24|28|31|34|36|38|42|45|47|51|53|57|59|62|63|64|66|67|70|71|72|75|78|79|81|83|87|89|81|89)-generic/ ||
           version =~ /^4\.8\.0-(34|36|39|41|45|46|49|51|52|53|54|56|58)-generic/
      vprint_error "Linux kernel version #{version} is not vulnerable"
      return CheckCode::Safe("Kernel version #{version} is not vulnerable")
    end
    vprint_good "Linux kernel version #{version} is vulnerable"

    vprint_status 'Checking if SMAP is enabled ...'
    if smap_enabled?
      vprint_error 'SMAP is enabled'
      return CheckCode::Safe('SMAP is enabled')
    end
    vprint_good 'SMAP is not enabled'

    config = kernel_config
    if config.nil?
      vprint_error 'Could not retrieve kernel config'
      return CheckCode::Unknown('Could not retrieve kernel config')
    end

    unless config.include? 'CONFIG_USER_NS=y'
      vprint_error 'Kernel config does not include CONFIG_USER_NS'
      return CheckCode::Safe('Kernel config does not include CONFIG_USER_NS')
    end
    vprint_good 'Kernel config has CONFIG_USER_NS enabled'

    unless userns_enabled?
      vprint_error 'Unprivileged user namespaces are not permitted'
      return CheckCode: