CVE-2025-9074-docker-escape

CVE-2025-9074-Docker Escape HTB MonitorsFour Este código es solo para fines educativos y entornos controlados como laboratorios Hack The Box. No usar en sistemas sin autorización. Este repositorio contiene un script de explotación para la vulnerabilidad Docker Remote API exposed sin autenticación...

HTB-Silentium-Writeup

HTB - Silentium Writeup Machine Info Name: Silentium OS: Linux Difficulty: Easy CVEs: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 Enumeration Nmap Scan root@kitploit: nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt Open ports: 22 SSH, 80 HTTP Virtual Hostsstaging.silentium.htb runs Flowise 3.0.5...

CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: Un Byte en el Verificador BPF para Escape de Contenedor Encontré un bug de solidez en el verificador BPF de Linux: un + 1 en una llamada pushstack que hace que el verificador omita una instrucción ALU en una ruta bifurcada. Para BPFOR, esto significa que el verificador rastrea dst...

CVE-2025-9074-Docker-Desktop-Container-Escape

CVE-2025-9074: PoC de Escape de Contenedor de Docker Desktop Exploit de Prueba de Concepto para CVE-2025-9074 - una vulnerabilidad crítica de escape de contenedor en Docker Desktop que permite acceso no autenticado a la API del Motor Docker. Resumen de la Vulnerabilidad Propiedad| Valor ---|--- I...

CVE-2024-21626-PoC

CVE-2024-21626 Causa raíz & Prueba de código ¿Cómo usar poc-autoplay? root@kitploit: make install make uninstall 1. Causa raíz En versiones de runc v1.1.11 e inferiores, al abrir el directorio /sys/fs/cgroup del host para configurar cgroups, se dejaba ese descriptor de archivo abierto sin cerrar...

Holistic-Deconstruction-of-CVE-2019-5736-

= doi.org/10.5281/zenodo.18304765 = orcid.org/0009-0007-7728-256X README.md 💀 CVE-2019-5736: Deconstrucción de Escape de Contenedor runc Análisis Avanzado de Purple Teaming y Forense de Escape de Raíz del Host 🛡️ Resumen Este repositorio contiene una deconstrucción de alta fidelidad y una Prueba d...

CVE-2026-84042

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

CVE-2026-88265

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

CVE-2026-84042

crun is a lightweight OCI container runtime. This flaw affects builds that include libkrun with passt networking enabled (krun.use_passt). When a container is started rootful , crun can execute an attacker-controlled payload embedded in the container image with host root privileges , effectively ...

CVE-2026-84042 Crun: crun: rootful krun with passt executes container payload as host root

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

CVE-2026-84042

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

CVE-2025-9074

CVE-2025-9074 – Full Docker Escape on Windows & macOS Docker Desktop 📌 Description Docker Desktop exposes the internal Docker Engine API at http://192.168.65.7:2375 to any running container — with no authentication and no access control. Because the engine itself can mount the host filesystem, a...

CVE-2026-31431-Copy-Fail

CVE-2026-31431 — "Copy Fail": Linux Kernel algifaead Local Privilege Escalation CISA KEV | CVSS 7.8 HIGH | Affects Linux kernels 4.14 – early 2026 9 years Table of Contents 1. Executive Summary 2. Risk Assessment 3. Technical Deep Dive 4. Attack Methodology — Red Team 5. Detection & Incident...

CVE-2026-31431-Container-Escape

CVE-2026-31431 Container Escape Container escape via runC...

copy-fail-CVE-2026-31431

CVE-2026-31431 Copy Fail exploit Author: pyroceper Tested on: Ubuntu 25.10 x8664 root@kitploit: $ make $ ./exploit Detected kernel: 6.17.0 Making backup of /etc/passwd to /tmp Backup saved as /tmp/passwd.bak Obtaining root shell... id uid=0pwn gid=0root groups=0root whoami pwn CREDITS & REFERENCE...

CVE-2026-31431-Copy-Fail-Container-Escape

CVE-2026-31431-Copy-Fail-Container-Escape Demo https://github.com/user-attachments/assets/2cb0cb67-789a-4461-a0b8-1fe878d9426e Prerequisite Container vulnerable to CVE-2026-31431 Container healthcheck configured and healthcheck CMD known Obtained root access inside the container if not, you can...

CVE-2026-31431

CVE-2026-31431 — Copy Fail 中文版 732 Bytes to Root on Every Major Linux Distribution CVE-2026-31431 Copy Fail is a logic bug in the Linux kernel's authencesn cryptographic template. It allows an unprivileged local user to trigger a deterministic, controlled 4-byte write into the page cache of any...

CVE-2026-31431-PocC

CVE-2026-31431-PoC CVE-2026-31431 PoC reproduced in C, usable for exploitation when Python is not available on the target environment. Vulnerability Basic Information Vulnerability type: Linux kernel AFALG subsystem page cache poisoning, achieving local privilege escalation and possible container...

yc-mk8s-copy-fail-mitigation

Copy Fail / Dirty Frag Mitigation for Yandex Managed Kubernetes Automatic application of mitigation for vulnerabilities CVE-2026-31431, CVE-2026-43284 and CVE-2026-43500 in the Linux kernel on all worker nodes of a Yandex Managed Kubernetes cluster. Vulnerability Description CVE ID: CVE-2026-4328...

copy-fail-CVE-2026-31431

Vulnerability Description Root Cause In 2017, the Linux kernel crypto module authencesn introduced an in-place optimization for AEAD Authenticated Encryption with Associated Data operations. This optimization caused read-only pages in the page cache to be incorrectly placed into a writable...