CVE-2016-4997
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local...
- Published
- Jul 3, 2016
- Updated
- Aug 6, 2024
- Assigning CNA
- redhat
- Evidence observed
- Sep 27, 2016
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 92.9%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
Sources
modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux($.exploit_linux/local/netfilter_priv_esc_ipv4.platform)
- verification: check_declared($.exploit_linux/local/netfilter_priv_esc_ipv4.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.