Stack-Clash.md

CVE-2017-1082, CVE-2017-1083, CVE-2017-1084, CVE-2017-1085, CVE-2017-3629, CVE-2017-3630, CVE-2017-3631, CVE-2017-1000364, CVE-2017-1000365, CVE-2017-1000366, CVE-2017-1000367, CVE-2017-1000369, CVE-2017-1000370, CVE-2017-1000371, CVE-2017-1000372, CVE-2017-1000373, CVE-2017-1000374, CVE-2017-1000375, CVE-2017-1000376, CVE-2017-1000377, CVE-2017-1000378, CVE-2017-1000379

• Report: Jun 19, 2017
• Credit: Qualys Corporation

PoC

CVE-2017-1084

• FreeBSD - 'FGPE' Stack Clash (PoC)
• FreeBSD - 'FGPU' Stack Clash (PoC)

CVE-2017-1085

• FreeBSD - 'setrlimit' Stack Clash (PoC)

CVE-2017-3629, CVE-2017-3630, CVE-2017-3631

• Oracle Solaris 11.1/11.3 (RSH) - Local Privilege Escalation 'Stack Clash' Exploit

CVE-2017-1000366, CVE-2017-1000370

• Linux Kernel (Debian 7/8/9/10 / Fedora 23/24/25 / CentOS 5.3/5.11/6.0/6.8/7.2.1511) - 'ldso_hwcap' Local Privilege Escalation 'Stack Clash' Exploit

CVE-2017-1000366, CVE-2017-1000371

• Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16.04.2/17.04 / Fedora 23/24/25) - 'ldso_dynamic' Local Privilege Escalation 'Stack Clash' Exploit

CVE-2017-1000366, CVE-2017-1000379

• Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64' Local Privilege Escalation 'Stack Clash' Exploit

CVE-2017-1000367

• Sudo - 'get_process_ttyname()' Privilege Escalation
• c0d3z3r0/sudo-CVE-2017-1000367

CVE-2017-1000370, CVE-2017-1000371

• Linux Kernel - 'offset2lib' 'Stack Clash' Exploit

CVE-2017-1000373

• OpenBSD - 'at' Local Privilege Escalation 'Stack Clash' Exploit

CVE-2017-1000375

• NetBSD - 'Stack Clash' (PoC)

Reference

• stack-clash.txt
• A Decade Old Unix/Linux/BSD Root Privilege-Escalation Bug Discovered
• CVE-2017-1000367 in Sudo's get_process_ttyname() for Linux
• Linux security alert: Bug in sudo’s get_process_ttyname() [ CVE-2017-1000367 ]