CVE-2016-2067

EXPLOTACIÓN DE IOMMU DMA EN GPU ADRENO Probado en Nexus 6p google/angler/angler:6.0.1/MMB29M/2431559:user/release-keys Acerca del bug Discutido en 2016 a través de Blackhat EU Acerca del exploit Con las escrituras de iommu dma, vdso.so se sobrescribe con shellcode. Así que después de que /init...

pcileech

PCILeech Summary: PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system. PCILeech also works without hardware together with a wide range of software memory acqusition methods supported by the...

pcileech

PCILeech 概述: PCILeech 使用 PCIe 硬件设备来读写目标系统内存。这是通过使用 PCIe 上的 DMA 实现的。目标系统上无需驱动程序。 PCILeech 在没有硬件的情况下也能与 LeechCore 库支持的多种软件内存获取方法配合使用——包括使用 DumpIt 或 WinPmem 捕获远程实时内存。PCILeech 还支持本地内存捕获以及多种内存转储文件格式。 PCILeech 支持多种内存获取设备，包括基于硬件和软件的。基于 USB3380 的硬件仅能原生读取 4GB 内存，但如果首先将内核模块（KMD）插入目标系统内核，则可以读取所有内存。基于 FPGA...

XenoboxX

Hardware-Sandbox-Toolkit Malware setzt häufig Anti-VM-Techniken ein, deren Erkennung und Bekämpfung unterschiedlich schwierig sein kann. Obwohl die Integration von Anti-Erkennungsmaßnahmen in unseren Laboren eine häufig genutzte Option ist, sollten wir auch den Einsatz einer echten Hardware-Sandb...

inception

Note: This tool is no longer under active development, please look at PCILeech instead. INCEPTION Inception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe HW interfaces...

inception

Nota: Esta herramienta ya no está en desarrollo activo; por favor, mira PCILeech en su lugar. INCEPTION Inception es una herramienta de manipulación de memoria física y hacking que explota DMA basado en PCI. La herramienta puede atacar a través de FireWire, Thunderbolt, ExpressCard, PC Card y...

Linux Distros Unpatched Vulnerability : CVE-2026-80886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from userspace and the kernel to the console can trigger a race condition that...

Linux Distros Unpatched Vulnerability : CVE-2026-80867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - alpha/PCI: Add securitylockeddown check to pcimmapresource Currently, Alpha's pcimmapresource does not check securitylockeddownLOCKDOWNPCIACCESS before allowing...

s6_pcie_microblaze

PCI Express DIY hacking toolkit General information Contents SP605 board configuration Software configuration Examples Using Python API Practical DMA attacks Option ROM attacks Troubleshooting Building project from the source code General information This repository contains a set of tools and...

SUSE CVE-2026-80831

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxsdcpaesblockcrypt uses sgdmalen without mapping the source scatterlist with dmamapsg first. Therefore, sgdmalen is invalid and could return zero or a stale DMA length,...

SUSE CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

SUSE CVE-2026-80867

In the Linux kernel, the following vulnerability has been resolved: alpha/PCI: Add securitylockeddown check to pcimmapresource Currently, Alpha's pcimmapresource does not check securitylockeddownLOCKDOWNPCIACCESS before allowing userspace to mmap PCI BARs. The generic version has had this check...

SUSE CVE-2026-80884

In the Linux kernel, the following vulnerability has been resolved: ntb: Store original DMA address for future release The DMA API requires that dmafreeattrs receive the exact dmahandle originally returned by the allocation function. Do not modify it...

SUSE CVE-2026-80886

In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from userspace and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages printed over and ov...

SUSE CVE-2026-80902

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA When terminating DMA transfers, active descriptors are not properly reclaimed. Only cyclic descriptors were handled, leaving non-cyclic descriptors and their LLI...

CVE-2026-51585

realtek poc Exploit de rt26cx21x64.sys familia Realtek PCIe GbE/2.5GbE/5GbE Descripción general El OID 0xFF816871 mapea el bar mmio de la NIC en el espacio de direcciones virtuales del proceso llamante, MmLockedPagesSpecifyCache, accesible desde modo usuario mediante \.\RealTekCardGUID Este IOCTL...

CVE-2026-80116

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on...

EUVD-2026-71687

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on...

CVE-2026-80116

CVE-2026-80116 affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) through a privilege escalation flaw in the DirectIo64.sys kernel driver. The root cause is unvalidated IOCTLs that permit local users to issue ar...

AZL-99450 CVE-2026-80902 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA When terminating DMA transfers, active descriptors are not properly reclaimed. Only cyclic descriptors were handled, leaving non-cyclic descriptors and their LLI...