Immunity Canvas: SHOW_TIMER_LEAK

2018-07-2619:29:00

Immunity Canvas

exploitlist.immunityinc.com

554

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

40.0%

Name	show_timer_leak
CVE	CVE-2017-18344 Exploit Pack
NOTES: This module gives an unpriviledged user the ability to dump a file from the kernel
memory. A common scenario is to dump the /etc/shadow or kerberos tickets.
Note: For Fedora, the attack is targetless while for Ubuntu / CentOS and others
you will need specific offsets compiled within the binary itself.
Caveats:
1. Attacking vmware, vbox or bare metal is absolutely the same, performance wise.
2. Some targets are still not supported.
3. Not all the filesystems are handled. In particular tmpfs or XFS files cannot be leaked.
4. With this version you can only dump files fitting within a single page (<= 4096 bytes)
5. SMAP mitigates this vulnerability
About (possible) future versions:
--------------------------------
A completely targetless version (not exclusive to Fedora) may be written later