HITCON-2023-Demo-CVE-2023-20562

HITCON 2023 데모 CVE-2023-20562 설명 이 데모는 대만에서 열린 HITCON 2023에서 진행되었습니다. 데모는 AMD μProf 내의 AMDCpuProfiler.sys를 악용하는 방법을 보여줍니다. EPROCESS 토큰에 대해 임의 쓰기를 트리거하여 SYSTEM 수준으로 권한 상승이 이루어집니다. DSE 플래그를 비활성화하면 악성 서명되지 않은 드라이버를 로드할 수 있습니다. 발표는 또한 360 Total Security의 ObRegisterCallbacks를 무효화하여 360 Total Security의...

CVE_2026_31694

CVE-2026-31694 Passive Scanner Linux 호스트를 수동 평가하는 도구로, Linux 커널의 FUSE readdir-cache out-of-bounds write 취약점인 CVE-2026-31694 를 대상으로 합니다. 이 스캐너는 실행 중인 커널, FUSE 노출 범위, 로컬 패키지 메타데이터, 커널 소스 증거, 실행 환경, 운영체제 계열을 평가합니다. 호스트가 영향을 받을 수 있는 경우, 감지된 배포판에 맞춰 완화 가이드를 생성합니다. 저자: Aung Myat Thu w01f 목차 개요 취약점 요약 보...

badspin

Bad Spin: Android Binder LPE Author: Moshe Kol 권한 상승 익스플로잇으로, unstrustedapp에서 Android Binder 취약점CVE-2022-20421을 대상으로 합니다. 이 취약점은 2022년 10월 Android 보안 게시판에서 패치되었습니다. 이 익스플로잇은 커널 버전 5.4.x 및 5.10.x를 실행하는 기기에서 작동하며, 완전한 커널 R/W 프리미티브를 달성합니다. Google Pixel 6의 경우 완전한 루트 권한 및 SELinux 우회도 획득합니다. 전체 작성 글은...

CVE-2022-0847-DirtyPipe-Exploit

이것은 무엇인가 이것은 Max Kellermann의 Dirty Pipe 개념 증명 코드이나, 루트의 /etc/passwd 비밀번호 필드를 덮어쓰고 루트 셸을 획득한 후 복원하도록 수정된 것입니다. 참고: 이 취약점을 발견하거나 개념 증명을 작성한 공로를 주장하지 않습니다. 이 익스플로잇은 단순히 Kellermann의 개념 증명을 빠르고 쉽게 악용할 수 있도록 약간 수정한 것입니다. 기회가 되면 이 매우 흥미로운 취약점에 대한 원문을 꼭 읽어보시기 바랍니다: https://dirtypipe.cm4all.com/ 그 글은 이해할...

CVE-2022-25636

CVE-2022-25636 これは私のCVE-2022-25636のエクスプロイトです。 Ubuntu 21.10 とカーネル5.13.0-30でテストしました。 約40%の確率で動作し、それ以外の場合はカーネルパニックが発生する可能性があります。 このエクスプロイトはヒープ上の重要なデータを破損する可能性があります。失敗した後は再起動することをお勧めします。...

CVE-2026-80632

A flaw was found in the Linux kernel's Wi-Fi driver, specifically within the mt7996 component. When the MT76NPU and CONFIGNETMEDIATEKSOCWED configurations are enabled and the Airoha NPU System-on-Chip SoC is detected, the mt7996inittxqueues function can attempt to dereference a NULL Wi-Fi/Etherne...

CVE-2026-80614

A flaw was found in the Linux kernel's emac network driver. An early interrupt in the emacirq handler can occur before the dev-emacp pointer is properly initialized. This can lead to a NULL pointer dereference, causing the system to crash and resulting in a Denial of Service DoS...

CVE-2026-80635

A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. This vulnerability occurs because the driver does not adequately validate the length of certain firmware responses. An attacker could potentially craft a malicious firmware response, leading to an out-of-bounds read of stale heap data...

CVE-2026-80723

A flaw was found in the of: reservedmem component of the Linux kernel. When the device tree defines more dynamic regions than the MAXRESERVEDREGIONS array can hold, the fdtscanreservedmem function performs an out-of-bounds write. This vulnerability can lead to memory corruption, potentially...

CVE-2026-80647

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA HNS driver. When the driver undergoes a reset, a completion queue handler is unexpectedly called, even though it is not intended to be active in its current operating mode. This incorrect invocation leads to the system issuin...

CVE-2026-80642

A flaw was found in the Linux kernel's liveupdate subsystem. This vulnerability arises from improper reference counting of incoming File-Lifecycle-Bound FLB data. A subsystem might hold onto FLB data for an extended period, and without proper reference counting, the FLB structure could be...

CVE-2026-80631

A flaw was found in the Linux kernel's Btrfs filesystem, specifically within its LZO decompression functionality. A local attacker could provide a specially crafted Btrfs image containing a compressed segment that, due to improper validation of its length, overflows the compressed input buffer...

ghostlock-x200-app

GhostLock X200 App vivo X200 向け、GhostLock（CVE-2026-43499）カーネル脆弱性に基づく端末内ワンタップ root App ：焼き込み不要、アンロック不要、データ消去不要。実行すると一時的な root を取得でき、再起動後は無効化され、再度 App を開けばワンタップで再 root できます。 これは ghostlock-x200-root（PC 版ツールチェーン）に対応する手机端エントリであり、同じ権限昇格チェーンを共有します。Shizuku（ワイヤレスデバッグによるブートストラップ対応）で権限を付与すれば利用可能で、PC の adb は...

CVE-2026-80652

A flaw was found in the Linux kernel's Cryptographic Co-processor CCP driver. A local attacker could trigger a kernel crash, leading to a denial of service DoS, by providing a zero-length certificate chain buffer during a Platform Dynamic Hardware PDH export operation. This issue specifically...

CVE-2026-80676

A flaw was found in the Linux kernel's Hyper-V hv VMBus driver. When a driver is being initialized, a specific callback function attempts to access a memory region driveroverride without proper synchronization. This oversight can lead to a Use-After-Free UAF vulnerability, where a local attacker...

CVE-2026-80672

A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability arises from an integer truncation error when validating the size of the $LogFile restart area and its log client record array. An attacker can exploit this by mounting a specially crafted NTFS image, leading to an...

CVE-2026-80671

A flaw was found in the Linux kernel's perf sched subsystem. Multiple vulnerabilities exist within the registerpid function when processing untrusted performance data. These include an integer overflow that can lead to out-of-bounds memory writes and a heap buffer overflow due to improper string...

CVE-2026-80620

A flaw was found in the Linux kernel. During the error handling of Message Signaled Interrupts eXtended MSI-X region setup, the kernel attempts to unmap an already freed memory region. This double unmap operation on a null pointer can lead to a kernel warning or crash. A local attacker could...

CVE-2026-80597

A flaw was found in the Linux kernel's mtd: maps: vmu-flash component. During the initialization of the Memory Technology Device MTD, a NULL pointer dereference can occur if the mtdinfo structure, which contains a device structure, is not properly linked to its parent. This issue can lead to the...

android_kernel_oneplus_avicii

OnePlus Nord avicii NeverSettle 커널 소스 OnePlus Nord 코드명: avicii는 2020년에 출시된 OnePlus Technology Co., Ltd.의 첫 번째 상위 중급형 비플래그십 스마트폰입니다. 이 전화기는 지역에 따라 AC2001 인도 및 AC2003 유럽 및 글로벌의 2가지 버전으로 제공됩니다. 기능| 사양 ---|--- 칩셋| Qualcomm Snapdragon 765G 5G SM7250-AB CPU| 옥타코어 1x2.4GHz 싱글코어 Kryo 475 Prime, 1x2.2GHz...