Due to insuficient checks when accessing the memory of a process vi /proc/PID/mem the linux kernel is prone to a Privilege escalation.
The kernel module loader in Linux kernel 2.2.x before 2.2.25, and 2.4.x before 2.4.21, allows local users to gain root privileges by using ptrace to attach to a child process that is spawned by the kernel. This module exploits this vulnerability and if is successful, install a new agent with root privileges.
On x86_64 Intel CPUs, sysret to a non-canonical address causes a fault on the sysret instruction itself after the stack pointer has been set to a usermode-controlled value, but before the current privilege level (CPL) is changed. A flaw in the ptrace subsystem of the Linux kernel allows a tracer process to set the RIP register of the tracee to a non-canonical address, which is later used when returning to user space with a sysret instruction instead of iret after a system call, thus bypassing sanity checks that were previously introduced to fix related vulnerabilities. This vulnerability can be used by a local unprivileged attacker to corrupt kernel memory and gain root privileges on the affected system.
Exploits a missing verification of parameters within the "vmsplice_to_user()", "copy_from_user_mmap_sem()", and "get_iovec_page_array()" functions in fs/splice.c before using them to perform certain memory operations. This can be exploited to e.g. read or write to arbitrary kernel memory via a specially crafted "vmsplice()" system call, and allows an unprivileged process to elevate privileges to root.
This module exploits a vulnerability in the udp_sendmsg function in the UDP implementation in net/ipv4/udp.c and net/ipv6/udp.c in the Linux kernel before 2.6.19 allowing local users to gain privileges via vectors involving the MSG_MORE flag and a UDP socket.
This module exploits a vulnerability in KOBJECT_UEVENT through an installed unprivileged agent, allowing the execution of arbitrary code with superuser privileges.
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket
The __sock_diag_rcv_msg() function in net/core/sock_diag.c of the Linux kernel does not validate the value of the sdiag_family field, which is used to index the sock_diag_handlers array. This can be exploited by a local unprivileged attacker to gain root privileges by sending a specially crafted Netlink message to the kernel.
This module exploits a local vulnerability in the set_fs function in the Linux kernel prior to 2.6.37.
Improper input validation in the RDS protocol implementation in the Linux kernel allows local unprivileged users to escalate their privileges and execute arbitrary code with root permissions. The RDS protocol does not properly check that the base address of a user-provided iovec struct points to a valid userspace address before using the __copy_to_user_inatomic() function to copy the data. By providing a kernel address as an iovec base and issuing a recvmsg() style socket call, a local user could write arbitrary data into kernel memory, thus escalating privileges to root.