CVE-2018-19323

CVE-2018-19323: GIGABYTE GDrv Exploitation Framework Overview This repository contains a complete and advanced exploitation framework for CVE-2018-19323 , a critical vulnerability in the GIGABYTE gdrv.sys driver. This vulnerability allows unprivileged users to read and write arbitrary...

GIGABYTE-H510M-K-V2-BIOS-SMM-Reverse-Engineering-CVE-2025-7026-7027-7028-7029-Research

GIGABYTE H510M K V2 BIOS — SMM 리버스 엔지니어링 및 CVE-2025-7026/7027/7028/7029 연구 GIGABYTE H510M K V2H510MKV2.F3 BIOS 이미지의 정적 리버스 엔지니어링: PI-spec SMM Core 메모리 할당자에 대한 전체 UEFI 펌웨어 볼륨 추출 분석과 GIGABYTE/Binarly가 2025년에 공개한 4가지 SMM 메모리 손상 취약점CVE-2025-7026 CVE-2025-7027 CVE-2025-7028 CVE-2025-7029에 대한 표적 탐색. 상태...

CVE-2018-19320-LPE

CVE-2018-19320 LPE 익스플로잇 설명 CVE-2018-19320의 로컬 권한 상승Local Privilege Escalation 익스플로잇입니다. 이 익스플로잇은 gdrv.sys 에 노출된 함수를 이용하여 낮은 권한의 사용자가 메모리에 데이터를 할당하고 쓸 수 있게 하여 권한을 SYSTEM으로 상승시킵니다. 스크린샷 테스트 환경: Windows 10 x64 21H1 OS Build 1903.1165 영향을 받는 버전 GIGABYTE APP Center v1.05.21 및 이전 버전 AORUS GRAPHICS...

gvcidrv64

ハッカー諸君。 GVCIDrv64.sys は Gigabyte の BIOS ユーティリティに同梱されている署名済みカーネルドライバーだ。これはセキュリティ記述子なしで \.\GVCIDrv64 を作成するため、管理者権限も UAC もなしに、任意のローカルユーザーがこれを開くことができる。アクセス制御が一切ない 3 つの IOCTL を公開している。32 MB の物理メモリのマップ 0x9C406580、アンマップ 0x9C406584、そして 1/2/4 バイトの生の I/O ポート読み書き 0x9C406588 だ。 巧妙なのは、このうち 2 つを組み合わせる方法だ。map...

CVE-2018-1932X

CVE-2018-1932X Rust Exploit POC for GIGABYTE APP Center v1.05.21 and earlier Just because your target is memory unsafe doesn't mean your exploit has to be! Vulnerabilities used : CVE-2018-19320 - ring0 memcpy-like functionality CVE-2018-19323 - read and write Machine Specific Registers MSRs...

CVE-2018-19320

CVE-2018-19320 Exploiting ring0 memcpy-like functionality to disable Driver Signing Enforcement DSE as documented here: http://deniable.org/windows/windows-callbacks References https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-19320...

CVE-2018-19321

CVE-2018-19321 CVE-2018-19321 설명 GIGABYTE APP Center v1.05.21 및 이전 버전, AORUS GRAPHICS ENGINE 1.57 이전 버전, XTREME GAMING ENGINE 1.26 이전 버전, OC GURU II v2.08의 GPCIDrv 및 GDrv 저수준 드라이버는 임의의 물리적 메모리를 읽고 쓸 수 있는 기능을 노출합니다. 이는 로컬 공격자가 권한을 상승시키는 데 악용될 수 있습니다...

Astra Linux – Vulnerability in glib2.0

A issue was discovered in GNOME GLib before versions 2.66.7 and 2.67.x before version 2.67.4. If the gbytearraynewtake function was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2^32, resulting in unintended length truncation...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: x86/mm/identmap: Use GB pages only when a full GB page should be mapped. When identpudinit uses only GB pages to create identity maps, large ranges of addresses that are not actually requested can be included in the resulting...

Astra Linux – Vulnerability in libxml2

In libxml2 versions before 2.9.14, several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer do not check for integer overflows. This can lead to out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software that uses libxml2’s...

Exploit for CVE-2025-7026

GIGABYTE H510M K V2 BIOS SMM Reverse-Engineering & CVE-2025-7...

JLSEC-2026-1155 Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in...

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1mbstringncopy can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In...

CVE-2026-66913

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-63091

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

CVE-2026-63091

ProFTPD mod_sftp in versions before 1.3.9c and 1.3.10rc3 contains a signed integer overflow in the SCP size-record parser. An authenticated, low-privilege attacker can send a crafted file size (UINT64_MAX) to produce a negative off_t, convert to uint32_t, and trigger ~4 GB read length, causing th...

EUVD-2026-45961

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

CVE-2026-63879

The CVE-2026-63879 entry relates to the Linux kernel DRM/AMDGPU stack, where a race in amdgpu_hmm_range_get_pages could allow operations on invalid pages due to reading the notifier sequence more than once. The issue has been resolved by a patch that fixes the range getter and also tidies coding ...

CVE-2026-63879 drm/amdgpu: fix amdgpu_hmm_range_get_pages

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpuhmmrangegetpages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the comm...

CVE-2026-9492

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...