Skip to content

Exploit does not map to CVE-2014-3153 on RHEL 7 #5

@jason-callaway

Description

@jason-callaway

CVE-2014-3153 should map to EDBID 35370, but it doesn't.

Reproducer

  1. Create instance
gcloud compute --project=${PROJECT} instances create test-1 \
    --zone=${ZONE} \
    --machine-type=n1-standard-1 \
    --subnet=default  \
    --image=rhel-7-v20190312 \
    --image-project=rhel-cloud \
    --boot-disk-size=20GB \
    --boot-disk-type=pd-standard \
    --boot-disk-device-name=instance-3
  1. Downgrade with cyber-range-target, site.yml:
- hosts: localhost
  connection: local
  become: true
  roles:
    - cyber-range-target
  vars:
    cves_to_test:
    - CVE-2014-3153

Apply with ansible-playbook site.yml.

  1. Attempt to map:
git clone https://github.com/redteam-project/exploit-curation
lem host assess --curation exploit-curation --kind stride --score 000009

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions