CVE-2018-19320-LPE

CVE-2018-19320 LPE 漏洞利用 描述 CVE-2018-19320 的本地权限提升漏洞利用。该漏洞利用使用了 gdrv.sys 中暴露的函数，允许低级别用户分配和写入内存数据，从而将权限提升至 SYSTEM。 截图 测试于: Windows 10 x64 21H1 OS Build 1903.1165 受影响版本 GIGABYTE APP Center v1.05.21 及更早版本 AORUS GRAPHICS ENGINE v1.33 及更早版本 XTREME GAMING ENGINE v1.25 及更早版本 OC GURU II v2.08 致谢 该漏洞由 Dieg...

CVE-2018-19323

CVE-2018-19323：技嘉 GDrv 利用框架 概述 本仓库包含针对 CVE-2018-19323 的完整高级利用框架，该漏洞存在于技嘉 gdrv.sys 驱动中。此漏洞允许无特权用户读写任意模型特定寄存器（MSR），从而导致完整的 Ring-0（内核）沦陷，并将权限提升至 NT AUTHORITY\SYSTEM。 该框架设计为模块化、健壮且功能丰富，为安全研究、红队行动和漏洞分析提供了全面的工具。 主要特性 完整内核利用： 通过泄露 IA32LSTAR MSR 获得内核基址并执行令牌窃取 shellcode，实现权限提升。 多架构支持： 动态适配 x86 、x64 和 ARM6...

CVE-2018-19321

CVE-2018-19321 CVE-2018-19321 描述 GIGABYTE APP Center v1.05.21 及更早版本、AORUS GRAPHICS ENGINE 1.57 之前版本、XTREME GAMING ENGINE 1.26 之前版本以及 OC GURU II v2.08 中的 GPCIDrv 和 GDrv 底层驱动程序暴露了读写任意物理内存的功能。本地攻击者可能利用此功能提升权限。...

CVE-2018-1932X

CVE-2018-1932X（Rust 漏洞利用 PoC）针对 GIGABYTE APP Center v1.05.21 及更早版本 仅仅因为你的目标内存不安全，并不代表你的漏洞利用也必须不安全！ 使用的漏洞： CVE-2018-19320 - ring0 memcpy-like 功能 CVE-2018-19323 - 读写机器特定寄存器 MSRs。 测试环境： 20H1：Windows 10 Kernel Version 19041 MP 1 procs Free x64 参考资源 Vergilius 项目：内核结构 技嘉补丁公告 KPCR 详情 环境要求 仅支持 x64...

CVE-2018-19320

CVE-2018-19320 Exploiting ring0 memcpy-like functionality to disable Driver Signing Enforcement DSE as documented here: http://deniable.org/windows/windows-callbacks References https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-19320...

GIGABYTE-H510M-K-V2-BIOS-SMM-Reverse-Engineering-CVE-2025-7026-7027-7028-7029-Research

技嘉 H510M K V2 BIOS SMM 逆向工程与 CVE-2025-7026/7027/7028/7029 研究 针对技嘉 H510M K V2（H510MKV2.F3）BIOS 镜像的静态逆向工程：完整地对 PI 规范 SMM Core 内存分配器进行 UEFI 固件卷提取分析，并定向搜寻 GIGABYTE/Binarly 于 2025 年披露的四个 SMM 内存破坏漏洞（CVE-2025-7026、CVE-2025-7027、CVE-2025-7028、CVE-2025-7029）。 状态：4 个 CVE 中已确认 1 个存在（CVE-2025-7027）。另外 3...

Astra Linux – Vulnerability in glib2.0

A issue was discovered in GNOME GLib before versions 2.66.7 and 2.67.x before version 2.67.4. If the gbytearraynewtake function was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2^32, resulting in unintended length truncation...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: x86/mm/identmap: Use GB pages only when a full GB page should be mapped. When identpudinit uses only GB pages to create identity maps, large ranges of addresses not actually requested can be included in the resulting table. For...

Astra Linux – Vulnerability in libxml2

In libxml2 versions before 2.9.14, several buffer handling functions in buf.c xmlBuf and tree.c xmlBuffer do not check for integer overflows. This can lead to out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software that uses libxml2’s...

Exploit for CVE-2025-7026

GIGABYTE H510M K V2 BIOS SMM Reverse-Engineering & CVE-2025-7...

JLSEC-2026-1155 Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in...

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1mbstringncopy can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In...

CVE-2026-66913

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-63091

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

EUVD-2026-45961

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers...

CVE-2026-63091

ProFTPD mod_sftp in versions before 1.3.9c and 1.3.10rc3 contains a signed integer overflow in the SCP size-record parser. An authenticated, low-privilege attacker can send a crafted file size (UINT64_MAX) to produce a negative off_t, convert to uint32_t, and trigger ~4 GB read length, causing th...

CVE-2026-63879

The CVE-2026-63879 entry relates to the Linux kernel DRM/AMDGPU stack, where a race in amdgpu_hmm_range_get_pages could allow operations on invalid pages due to reading the notifier sequence more than once. The issue has been resolved by a patch that fixes the range getter and also tidies coding ...

CVE-2026-63879 drm/amdgpu: fix amdgpu_hmm_range_get_pages

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpuhmmrangegetpages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the comm...

CVE-2026-9492

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...

CVE-2026-9492 GIGABYTE｜Gigabyte Control Center - Improper Access Control

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...

CVE-2026-9492

CVE-2026-9492 affects Gigabyte Control Center (GCC) MBStorage DRAM lighting control module. The vulnerability resides in the MyPortIO_x64.sys driver, where improper access control allows authenticated local attackers to issue IOCTL commands that can read and write physical memory, leading to kern...