Re:Escaping Docker container using waitid() – CVE-2017-5123
by geofft on Friday December 29, 2017 @04:19PM
(#16032061)
> Edit2: Additionally this CVE relies on the getuid syscall being available
This exploit relies on it. The vulnerability does not. The exploit happens to use getuid() along the way to using heap spraying, but the writeup is pretty clear that neither getuid() nor heap spraying is required.
Re:Escaping Docker container using waitid() – CVE-2017-5123
by hacknat on Friday December 29, 2017 @04:46PM
(#16032230)
Yeah and I’m wrong about that part anyways. You can’t cap out or block getuid without breaking glibc. I meant setuid, but that call isn’t used in this exploit. I got confused.
This exploit relies on it. The vulnerability does not. The exploit happens to use getuid() along the way to using heap spraying, but the writeup is pretty clear that neither getuid() nor heap spraying is required.