# doesn't work: CVE-2016-8655 Linux af_packet.c race condition

## toralf

Hi,

at my system I can't get that exploit (http://seclists.org/oss-sec/2016/q4/621) to succeeded under a vanilla kernel 4.9-rc7 (hardened even more not). I do always get:

```
linux AF_PACKET race condition exploit by rebel

i have no offsets for this kernel version..

kernel version: 4.9.0-rc7 #1 SMP Thu Dec 8 10:19:36 CET 2016

```

Are there any other preconditions I do have to met ?

----------

## Apheus

From the source:

```
struct offset offsets[] = {

    {"4.4.0-46-generic #67~14.04.1",0xffffffff810842f0,0xffffffff81e4b100,0xffffffff81274580,0xffffffff8106b880},

    {"4.4.0-47-generic #68~14.04.1",0,0,0,0},

    {"4.2.0-41-generic #48",0xffffffff81083470,0xffffffff81e48920,0xffffffff812775c0,0xffffffff8106c680},

    {"4.8.0-22-generic #24",0xffffffff8108ab70,0xffffffff81e47880,0xffffffff812b34b0,0xffffffff8106f0d0},

   ...

```

These are necessary data, different for every kernel, and have only been collected for ubuntu kernels. You would have to find the offsets for a given custom kernel. I would like to know too how this can be done.

----------

## kernelOfTruth

+1

----------

## derk

doesn't the 4.9.0 kernel have the fix patch in place? or is this rc before the patch (dec 2,2016) release?

----------

