CVE-2017-5669

What it actually does

The flaw in do_shmat allows a local process to calculate an address via rounding that maps page zero, bypassing mmap's protection mechanism when invoked through crafted shmget and shmat calls from a privileged context.

Why it matters to the business

Local attackers can gain elevated privileges on Linux systems, potentially leading to full host compromise, data access, or persistence that disrupts operations and increases breach risk.

How an attack unfolds

An attacker with local shell access crafts shmget and shmat system calls that exploit the unchecked rounding in shmat to map page zero, bypassing intended mmap restrictions and enabling further privilege escalation within the kernel.

How to fix it

Update the Linux kernel to a version containing commit 95e91b831f87ac8e1f8ed50c14d709089b4e01b8 or later; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Confirm the running kernel includes commit 95e91b831f87ac8e1f8ed50c14d709089b4e01b8 via git log or version string checks; test that shmat calls no longer permit page-zero mappings in privileged contexts.

Typical attack path

1. Gain local user access on the target system
2. Identify or create a privileged context for IPC operations
3. Issue crafted shmget call to allocate shared memory segment
4. Invoke shmat with parameters that trigger the rounding flaw to map page zero
5. Leverage the resulting mapping to bypass protections and escalate privileges

How to detect it

Review system call audit logs for unusual shmget or shmat invocations from non-standard processes; examine kernel logs around IPC operations for anomalous address mappings or page-zero references.

What your security team should do

• Prioritize kernel upgrades across all affected Linux deployments to the fixed commit
• Audit systems for local privilege-escalation vectors and restrict unnecessary IPC usage
• Monitor for post-patch stability and schedule validation testing
• Review and harden local user permissions to limit exploitation opportunities