prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2

A flaw was found in util-linux. The mount8 SUID binary does not sanitize the LIBMOUNTFORCEMOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount8 to use the legacy two-step mount2 code path, which applies security restrictions such as nosuid and...

util-linux: TOCTOU in the mount program via ancestor directory swap on target path

When an /etc/fstab entry is configured with the user or users option, mount8 validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use TOCTOU window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that...

util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes

A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount8 changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this...

util-linux: TOCTOU in the mount program when setting up loop devices

A flaw was found in util-linux. When an /etc/fstab entry is configured with the user,loop options, the mount program checks the file path with user permissions but later opens it with root privileges. This creates a brief Time-of-Check-Time-of-Use TOCTOU window where an attacker can substitute th...

util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks

When an external mount. helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode...

util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

Important: Red Hat Security Advisory: util-linux security update

An update for util-linux is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

vibebox

an ultrafast, open-source sandbox for running coding agents safely. English | 简体中文 VibeBox is a per-project micro-VM sandbox for running coding agents on macOS Apple Virtualization Framework. It’s optimized for a daily-driver workflow: fast warm re-entry, explicit mounts, and reusable sessions. W...

airgap

airgap Security for the modern AI age. No security layer is perfect. airgap is still experimental. Contributions welcome! Protected secrets airgap launches a target program e.g. an AI coding agent inside its own mount namespace and transparently replaces secrets with redacted versions. A program...

CVE-2026-117685

The Gitea OCI registry contains a vulnerability where a public-only token with write:package scope can be used to mount a private package blob into a public package namespace. The root cause is an Incorrect Authorization (CWE-863) flaw where the system validates the target package against the tok...

docker_cve-2015-2925

Docker + CVE-2015-2925 = escaping from --volume Recent vulnerability in Linux known for about half of the year several months publicly made it possible to escape from bind mounts. In particular in case of Docker it's possible to escape from inside the directory mounted via --volume option to the...

rtty_CVE-2025-56708-CVE-2025-56709

CVE-2025-56708&CVE-2025-56709 【CVE-2025-56709】savepath Buffer Overflow Vulnerability Overview In rtty totalsize = ctx-remainsize = bufferpullu32beinfo; ment = findmountpointsavepath; if ment uint64t avail; if !strcmpment-mnttype, "ramfs" struct sysinfo si; if sysinfo&si logerr"download file fail:...

CVE-2025-9074-docker-escape

CVE-2025-9074-Docker Escape HTB MonitorsFour This code is for educational purposes only and controlled environments such as laboratories Hack The Box. Do not use on systems without authorization. This repository contains an exploit script for the Docker Remote API exposed without authentication...

DriverJack

DriverJack Introduction DriverJack is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To...

CVE-2025-34159

CVE-2025-34159: Docker Compose Injection in Coolify Vulnerability Overview Field| Value ---|--- CVE ID| CVE-2025-34159 Affects| Coolify ≤ v4.0.0-beta.420.6 Fixed in| v4.0.0-beta.420.7 Severity| Critical CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE| CWE-78 OS Comma...

CVE-2024-21626

Usage: 1.git clone https://github.com/cdxiaodong/CVE-2024-21626 2.docker-compose up Verification: If you can obtain the host's /etc/passwd, the vulnerability exists. Environment: runc: =v1.0.0-rc93,=1.1.11 Attack details & principle: In affected versions of runc, during initialization, some...

CVE-2023-42931

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ macOS Privilege...

CVE-2024-0132

CVE-2024-0132 CVE-2024-0132 PoC Let's start by deciding on a base image. The arrangement of libraries in the system depends on what it will be. For example, for alpine it will be /usr/lib64/, for ubuntu it will be /usr/lib/x8664-linux-gnu. We will use ubuntu as a base image. FROM ubuntu The nvidi...

CVE-2026-7867-disk2root

Filesystem.Mount → as-user Spoofing → Authorization Bypass → Root-context Mount → LPE Overview CVE-2026-7867 is a local privilege escalation vulnerability in udisks2 involving the Filesystem.Mount D-Bus method, the as-user option, fstab-managed mount flows...