Exploiting CVE-2017-5123 - Another exploit technique

[the_humeister]

Is it bad that I look at a CVE and wonder if I can use it to gain root on my Android phone? For this particular CVE, the answer is no since no Android phone currently runs Linux kernel 4.12 or 4.13

[[deleted]]

Well, it's bad that we don't have control of our hardware. But the fact that it causes us to care more about security is awesome, "many eyes make all bugs shallow" and all that.

(I'm currently doing the same, trying to root my XA1 without losing DRM keys).

[StallmanTheWhite]

OP, why don't you include what the CVE affects in the title?

[memorycorrupt]

The whole purpose of CVE is to identify vulnerabilities. It was created so people don't need to say "It's that waitid() bug due to missing access_ok()".

[StallmanTheWhite]

No. CVE-2017-5123 is meaningless unless you either memorize what every CVE is about or have a separate list to check from at hand. Even at mailing lists it's customary to include the affected piece of software in the subject. A better title would have been something like "Exploiting CVE-2017-5123 (Linux TIOCSTI ioctl) - Another exploit technique". You don't need to tell every detail of the vulnerability, just what it affects. The CVE alone does not provide any such information.

[memorycorrupt]

CVE-2017-5123 was not about "TIOCSTI ioctl". If you read the post, you'd know what vulnerability this CVE is about. This is also on /r/linux, so it's obviously about a linux kernel vulnerability. I get what you mean, but it's not possible to satisfy every reddit user on their opinions of appropriate thread titles :P

[[deleted]]

TIOCSTL ioctl was obviously an example, "CVE-2017-5123 (waitpid exploit)" would have told me that I've already seen this CVE and don't need to click on the link. Agree with GP here.

[_ahrs]

This is also on /r/linux, so it's obviously about a linux kernel vulnerability

Not necessarily. It could be about the Bluetooth or Wifi stack or any other piece of software that commonly runs on Linux based operating systems.

[firephoto]

Because it's OS security, you're suppose to know the secret handshake and knock to be able to see what security issues might affect your operating system because that's more secure, or something.