KernelPatch

KernelPatch 仅使用经过裁剪的 Linux 内核镜像来修补和挂钩 Linux 内核。 | |/ / | | \ | | | | | ' // \ '| ' \ / \ | | / | / | ' \ | . \ / | | | | | / | / | | || | | | | ||\|| || ||||| ,|\|| || 在没有源代码和符号信息的情况下获取所有符号信息。 向内核注入任意代码。（静态修补内核镜像或运行时动态加载）。 提供内核函数内联挂钩和系统调用表挂钩。 为 Android 提供额外的 SU。 如果你使用的是 Android，APatch 会是更好的选择。...

KernelPatch

KernelPatch 仅使用经过裁剪的 Linux 内核镜像来对 Linux 内核进行补丁和挂钩。 | |/ / | | \ | | | | | ' // \ '| ' \ / \ | | / | / | ' \ | . \ / | | | | | / | / | | || | | | | ||\|| || ||||| ,|\|| || 在没有源代码和符号信息的情况下获取所有符号信息。 向内核注入任意代码。（对内核镜像进行静态补丁或运行时动态加载）。 提供内核函数内联挂钩和系统调用表挂钩。 为 Android 提供额外的 SU。 如果你使用的是 Android，APatch...

-Help-vivo-Y200i-5.10.218-GKI-CVE-2026-43499-stack-reclaim-reaches-0x300-need-0x318

-Help-vivo-Y200i-5.10.218-GKI-CVE-2026-43499-stack-reclaim-reaches-0x300-need-0x318 设备：vivo Y200i PD2354C，Snapdragon 4 Gen 2 SM4450，Android 14 / OriginOS 4 内核：5.10.218-gki-g3a51ea9d5834（39 位 VA，4K 页，KASLR 开启，STACKLEAK=y，无 SVE） 目标：通过 CVE-2026-43499 GhostLock 实现临时 root。 目前进展： KernelSnitch 泄漏成功...

CVE-2021-28664-PoC

CVE-2021-28664-PoC Mali kbase GPU 驱动 UAFCVE-2021-28664→ 内核任意物理内存 读/写原语 的 PoC 骨架。面向通用 ARM64 Android 平台,与任何具体厂商、机型无关。 研究范围 仅到"内核任意物理内存读/写原语"为止 :如何把一个 GPU 驱动的 use-after-free 变成稳定、可控、可安全失败的内核内存读写能力。 本仓库不提供任何攻击。 不含成品 exploit、不含可直接运行的代码、 不含任何设备的偏移量/序列号/固件;禁止将任何内容用于攻击行为见下。 免责声明 / Disclaimer必读 1. 本仓库不提供攻...

USN-8816-4 linux-gke vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - S390 architecture; - x86 architecture; - DRBD Distributed Replicated Block Device drivers; -...

USN-8818-6: Linux kernel (FIPS) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

GhostLock-NVIDIA-Shield-9.2.4

适用于 NVIDIA Shield TV Pro 9.2.4 的 GhostLock 经验证的 arm64 移植版本，针对运行 Shield Experience 9.2.4 的 2019 款 NVIDIA Shield TV Pro（mdarcy）上的 GhostLock futex PI use-after-free（CVE-2026-43499）。该载荷会修改实时 ADB 守护进程的凭据，因此无需解锁引导加载程序、擦除用户数据、安装 su 或修改已验证分区，新的 ADB shell 即可获得 UID 0。 这是一个针对特定构建的内核漏洞利用，仅用于授权安全研究。...

copyfail-arm64

Copy Fail ARM64 Research CVE-2026-31431 Analysis and ARM64 reproduction of the Copy Fail Linux kernel privilege escalation vulnerability CVE-2026-31431, originally disclosed by Xint. Blog post: Copy Fail on ARM64: Understanding and Porting CVE-2026-31431 What's Included File| Description ---|---...

copy-fail-CVE-2026-31431-C

copy-fail-CVE-2026-31431-C 已在 ubuntu 18.04、ubuntu 20.04、ubuntu 22.04、kali 2024、kali 2025、kali 2026 上验证 gcc -o exploit exploit.c -lz && chmod +x exploit && ./exploit 已在 ubuntu 25.04 arm64 上验证 gcc -o exploit exploitaarch64.c -lz && chmod +x exploit && ./exploit...

cve-2024-7965-poc

cve-2024-7965-poc CVE-2024-7965是Google Chrome浏览器中V8 JavaScript引擎的一个高危漏洞。该漏洞源于V8引擎在处理特定JavaScript代码时实现不当，导致堆内存损坏。攻击者可通过诱导用户访问包含特制JavaScript的恶意网页，利用此漏洞在Chrome渲染器中执行任意代码。成功利用该漏洞可能导致浏览器崩溃、信息泄露，甚至完全控制受害者的浏览器环境。该漏洞的CVSS评分为8.8，表明其危害性较高。...

CVE-2025-59489-POC

CVE-2025-59489-POC CVE-2025-59489 的概念验证（PoC），据我所知是同类中的首个。用于检测 Android 设备上受影响的 Unity 游戏。已在 API26、Android 11 上，针对 2025 年 9 月 29 日版本的 Battle Nations 进行测试。仅包含 arm64-v8a 架构 ，如有需要，请自行编译 libpreinit.so 并添加到 jniLibs/ 目录中。 参考文章...

CVE-2026-43499_HW-CLT-AL01

CVE-2026-43499 Android arm64 本地提权适配 English | 中文 这是一个用于 CVE-2026-43499 的 Android arm64 本地提权适配项目。 项目会根据目标设备的 boot.img 和 profile 信息生成 target.h，然后编译出对应的 preload.so。 说明：本项目是通用适配框架，不绑定单一机型。实际是否可用，以 generatetarget.py 能否成功生成 target.h 以及真机测试结果为准。 目录结构 项目目录/ ├── boot.img 目标设备同固件 boot 镜像 ├── profile.json...

ghostlock-custom

GhostLock Custom — CVE-2026-43499 适配版 针对 非 Android Linux 6.x ARM64 内核的 GhostLock CVE-2026-43499 提权利用。 内核特征 项目| 值 ---|--- 架构| ARM64 AArch64 VABITS| 39 KIMAGETEXTBASE| 0xffffffc008000000 内核版本| 6.x SELinux| 无 ashmem| 无 configfs| 无 编译 本地编译 需要交叉编译器 make Android NDK 编译 make android-arm64...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc (crlsa-2025_3264)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253264 advisory. kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array CVE-2025-21785 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc (crlsa-2025_3260)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253260 advisory. kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array CVE-2025-21785 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2025_1067)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20251067 advisory. kernel: scsi: core: Fix unremoved procfs host directory regression CVE-2024-26935 kernel: arm64/sve: Discard stale CPU state when handling SVE traps...

Ubuntu 20.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8849-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8849-1 advisory. It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2023_1809)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231809 advisory. Thunderbird: Revocation status of S/Mime recipient certificates was not checked CVE-2023-0547 Mozilla: Matrix SDK bundled with Thunderbird vulnerable to...

openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V

A flaw was found in OpenSSL. The optimized scalar point multiplication used for SM2 cryptographic operations on ARM64 and RISC-V architectures does not execute in constant time. An attacker capable of measuring execution times or observing processor cache-access patterns can exploit this side...

openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V

A flaw was found in OpenSSL. The optimized scalar point multiplication used for SM2 cryptographic operations on ARM64 and RISC-V architectures does not execute in constant time. An attacker capable of measuring execution times or observing processor cache-access patterns can exploit this side...