Loading vulnerability…
CVE-2017-7308 is a local vulnerability in the Linux kernel AF_PACKET implementation, specifically in the packet_set_ring function in net/packet/af_packet.c, affecting Linux kernel versions through 4.10.6. The flaw is caused by improper validation of block-size-related input when configuring packet ring buffers via crafted system calls. This leads to an integer signedness issue that can result in an out-of-bounds write in kernel memory. Successful exploitation can crash the kernel or be leveraged for local privilege escalation. The vulnerability has also been discussed in the context of packet socket exploitation from containers where access to the packet socket subsystem is available.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository contains a single Metasploit module (Ruby file) that exploits CVE-2017-7308, a heap out-of-bounds write vulnerability in the Linux kernel's AF_PACKET implementation (packet_set_ring function). The exploit targets Ubuntu Xenial kernels 4.8.0-34-generic through 4.8.0-45-generic and related distributions (e.g., Linux Mint 18). The module uploads and executes a local privilege escalation exploit, either compiling it on the target (if gcc is available) or uploading a pre-compiled binary. After successful exploitation, a custom payload (such as a Meterpreter or shell) is executed as root, granting full system access. The module includes checks for kernel version, architecture, user namespace support, and other requirements. The only fingerprintable endpoint is the default writable directory (/tmp) used for file uploads. The exploit is operational and provides root access if the target is vulnerable and properly configured.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Уязвимость kernel LPE в af_packet, упомянутая как сравнительный пример эксплойта, зависящего от user namespaces.
A Linux kernel overflow vulnerability cited as an example where the vulnerable object is allocated via the buddy allocator, limiting the effectiveness of AUTOSLAB’s slab-cache isolation approach.
A Linux packet sockets vulnerability referenced as historical background for exploitation techniques involving packet rings and page vectors.
A Linux kernel packet socket use-after-free vulnerability in 4.8.x kernels that can be exploited for kernel code execution, particularly when CAP_NET_RAW is available.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.