Jump-over-ASLR-BTB

분기 예측기 및 ASLR 저자: Byte Reaper 설명 이 저장소는 ASLR주소 공간 레이아웃 무작위화 맥락에서 분기 예측기, 추측 실행 및 캐시 기반 부채널과 관련된 개념을 시연하는 연구용 C 구현을 포함합니다. 요구 사항 : root@kitploit: Linux x8664 GCC CPU that supports BTB 빌드 : root@kitploit: gcc btb.c -o BTB ./BTB 빠른 출력 예시: root@kitploit: + check System Security for Check branch...

CVE-2023-0045

Linux에서 Spectre-BTI 사용자 공간 완화 우회하기 작업 중인 문서입니다. 잘못된 내용이 있거나 누락된 인용이 있다면 피드백을 보내주세요 버전 1.0 José Oliveira esoj Rodrigo Branco BSDaemon 소개 Spectre-BTI 공격의 성공률을 테스트하던 중, 커널 API를 완화 수단으로 사용할 때 이상한 패턴을 발견했습니다1. 테스트 결과 Linux 커널이 공격을 올바르게 완화하지 못하여 syscall 이후 짧은 시간 동안 프로세스가 노출된 상태로 남는 것으로 나타났습니다. 추가 조사 결과...

CVE-2021-33624

CVE-2021-33624 の概念実証 コンパイル方法 gcc -pthread -o bpfspectretypeconfusion bpfspectretypeconfusion.c -Wall -ggdb -std=gnu99 実行方法 sudo ./bpfspectretypeconfusion 1 2 ffffffffa4925620 0x10 ここで、1 と 2 は異なるハードウェアコアで動作する CPU スレッド、ffffffffa4925620 は漏洩させたい対象メモリ、0x10 は漏洩させるバイト数です。このエクスプロイトは修正されていますが、sudo...

spectre-attack-example

Spectre 공격 예제 2018년 1월 2일 CVE-2017-5753 및 CVE-2017-5715 "유령" Spectre 취약점 이용 예시 이게 뭔가요? 우리는 "The Magic Words are Squeamish Ossifrage." 라는 텍스트를 메모리에 저장하고, 취약점을 이용해 이를 읽으려고 시도합니다. 시스템이 취약하다면, 표준 출력에서 동일한 텍스트를 볼 수 있습니다. 이 코드에서, victimfunction 내의 컴파일 명령이 엄격한 프로그램 순서로 실행된다면, 해당 함수는 array1 크기 = 16이므로...

Astra Linux – Vulnerability in Linux 5.15, Linux

Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type, potentially leading to information disclosure...

CVE-2026-64507

A flaw was found in the Linux kernel. This vulnerability involves an incomplete defense against Spectre-v2, a type of attack that can expose sensitive information by exploiting how modern processors predict future operations. Specifically, when the Berkeley Packet Filter BPF Just-In-Time JIT...

SUSE CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

UBUNTU-CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508 bpf: Support for hardening against JIT spraying

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508 bpf: Support for hardening against JIT spraying

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508

CVE-2026-64508 relates to a Linux kernel vulnerability in BPF JIT memory reuse. The issue arises when the BPF JIT allocator reuses space for new programs, potentially letting indirect jumps reuse stale branch predictions. Fix implemented: flush indirect branch predictors on JIT memory reuse via a...

CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64507 x86/bugs: Enable IBPB flush on BPF JIT allocation

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF...

Linux Distros Unpatched Vulnerability : CVE-2026-64508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those...

Astra Linux – Vulnerability in Linux, Linux 5.10

The non-transparent sharing of the branch predictor within the context of some Intel processors may allow an authorized user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in Linux 5.10, Linux

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ibprctlset function updates the Thread Information Flags TIFs for the task and updates the SPECCTRL MSR in the function speculationctrlupdate, but the IBPB is only issued at the next schedul...

Astra Linux – Vulnerability in Linux, Linux 5.10

The non-transparent sharing of branch predictor selectors between contexts in some Intel processors may allow an authorized user to potentially enable information disclosure through local access...

xiangshan-bpu-asid-poc

XiangShan Cross-ASID BPU Leak PoC Minimal proof of concept fo...

SUSE SLED15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2026:0329-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0329-1 advisory. - CVE-2025-58150: Fixed buffer overrun with shadow paging and tracing XSA-477 bsc1256745 - CVE-2026-23553: Fix...