2022-LPE-UAF

2022-LPE-UAF 未经测试的 POC 代码 安全研究人员在 Linux 内核中发现了 3 个漏洞，本地攻击者可能利用这些漏洞提升权限并可能执行恶意代码。概念验证代码已公开可用，增加了在野利用的可能性。 Zhenpeng 的 Dirtycred 论文 https://zplin.me/papers/DirtyCred-Zhenpeng.pdf DirtyCred 的补丁及 PoC 的公开发布 https://github.com/Markakd/DirtyCred CVE-2022-2585 - Linux 内核 POSIX CPU 定时器 UAF 'PoC' 代码来源：...

2022-LPE-UAF

2022-LPE-UAF 未テストのPOCコード セキュリティ研究者は、ローカル攻撃者が権限を昇格させ、悪意のあるコードを実行する可能性があるLinuxカーネルの3つの脆弱性を発見しました。概念実証コードが公開されており、実際の環境での悪用の可能性が高まっています。 Zhenpeng氏によるDirtycredに関する論文 https://zplin.me/papers/DirtyCred-Zhenpeng.pdf DirtyCredのパッチとPoCの公開リリース https://github.com/Markakd/DirtyCred CVE-2022-2585 - Linux kern...

poc-CVE-2025-38352

🚀 poc-CVE-2025-38352 - セキュリティツールの簡単ダウンロード 📥 今すぐダウンロード 📖 概要 このアプリケーションはCVE-2025-38352の概念実証です。LinuxカーネルのPOSIX CPUタイマー実装における脆弱性を示します。2025年9月のAndroidセキュリティ情報によると、この脆弱性は限定的な環境で標的型攻撃に使用されています。 🖥️ システム要件 このアプリケーションをスムーズに実行するには、システムが以下の要件を満たしていることを確認してください。 オペレーティングシステム: Linux（最新のディストリビューション） カーネルバージョン:...

chronomaly-webos

Chronomaly — CVE-2025-38352 on LG webOS CVE-2025-38352（POSIX CPUタイマーの競合条件／use-after-free）を悪用したカーネルエクスプロイト。LG webOS Smart TV上で、ARM64のカーネル5.4.268で動作し、永続的なルート権限を取得します。複数のファームウェアバージョンを持つ4つのTVモデルで検証済み。LGのSecurity Researcher Programに責任を持って開示（2026年2月）。 farazsth98 によるChronomalyを基に構築。Stage...

CVE-2025-38352-PoC

CVE-2025-38352: Linux カーネル POSIX CPU タイマー TOCTOU 競合状態と UAF CVE-2025-38352 の再現可能な概念実証 PoC および自動化された GDB オーケストレーションスクリプトです。これは Linux カーネルの POSIX CPU タイマーサブシステム kernel/time/posix-cpu-timers.c における Time-of-Check to Time-of-Use TOCTOU 競合状態であり、Use-After-Free UAF を引き起こします。 免責事項:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Clean up CPU timers before freeing them during exec. The commit 55e8c8eb2c7b “posix-cpu-timers: Store a reference to a pid instead of a task” introduced a mechanism to retrieve tasks by PID when deleting a CPU...

SUSE CVE-2026-72068

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in updaterlimitcpu updaterlimitcpu converts the RLIMITCPU value to nanoseconds with u64 nsecs = rlimnew NSECPERSEC; On 32-bit kernels both rlimnew unsigned long and NSECPERSEC 1000000000L...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100140)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100140 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond...

CVE-2026-72068 posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in updaterlimitcpu updaterlimitcpu converts the RLIMITCPU value to nanoseconds with u64 nsecs = rlimnew NSECPERSEC; On 32-bit kernels both rlimnew unsigned long and NSECPERSEC 1000000000L...

PT-2026-72257

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in update rlimit cpu update rlimit cpu converts the RLIMIT CPU value to nanoseconds with u64 nsecs = rlim new NSEC PER SEC; On 32-bit kernels both rlim new unsigned long and NSEC PER SEC...

CVE-2026-64560

A flaw was found in the Linux kernel's CPU timer functionality. A race condition, which is a timing issue between different operations, can occur when a process attempts to delete a timer while another operation is still trying to access it. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-64560

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

SUSE CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

CVE-2026-64370 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

PT-2026-64591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A pid refcount leak occurs in the do cpu nanosleep function. The posix cpu timer create function acquires a pid reference using get pid and stores it in timer.it.cpu.pid. If the followin...

SUSE-SU-2026:20635-1 Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise kernel 6.12.0-160000.5.1 fixes various security issues The following security issues were fixed: - CVE-2025-38352: posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel bsc1249205. - CVE-2025-39698: iouring/futex: ensure iofutexwait...

kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

A race condition was found in the Linux kernel’s POSIX CPU timer handling, where handleposixcputimers may run concurrently with posixcputimerdel on an exiting task which could result in use-after-free scenarios. An attacker with local user access could use this flaw to crash or escalate their...

kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

A race condition was found in the Linux kernel’s POSIX CPU timer handling, where handleposixcputimers may run concurrently with posixcputimerdel on an exiting task which could result in use-after-free scenarios. An attacker with local user access could use this flaw to crash or escalate their...