hyperv_local_dos_poc

Hyper-V 拒绝服务概念验证。 这是 Visual Studio 2019 驱动程序项目的代码文件。 1. 编译驱动程序。 2. 使用以下命令为客户操作系统启用嵌套虚拟化： root@kitploit: Set-VMProcessor -VMName -ExposeVirtualizationExtensions $true 3. 在客户操作系统内运行驱动程序。主机操作系统将重启或生成带有 HYPERVISORERROR 代码的蓝屏死机。 该漏洞存在于 Hyper-V 中，影响 Windows Server 2019、安装了最新补丁的 Windows 10 以及 Windows 10...

s6_pcie_microblaze

Kit de hacking DIY para PCI Express Información general Contenido Configuración de la placa SP605 Configuración del software Ejemplos Uso de la API de Python Ataques DMA prácticos Ataques a la Option ROM Solución de problemas Compilación del proyecto desde el código fuente Información general Est...

CVE-2021-28476

CVE-2021-28476: Microsoft Hyper-V：vmswitch 中的多个漏洞 在处理 set OID 请求时，WPP 代码中存在多个 bug，其中一个允许解引用（读访问）攻击者控制的指针，其余的导致越界读访问。此仓库包含用于触发已识别问题的概念验证代码。 可在 https://labs.bluefrostsecurity.de/advisories/bfs-sa-2021-001/ 找到问题的完整技术描述。...

gerhart01

gerhart01 CVE-2020-0890 | Windows Hyper-V 拒绝服务漏洞的概念验证代码...

HyperDeceit

HyperDeceit This repository contains the full source-code of the HyperDeceit project which is a library that allows you to impersonate as Hyper-V and intercept hypercalls done by the Windows kernel. Blog post: https://reversing.info/posts/hyperdeceit/ Disclaimer The code has not been through prop...

CVE-2021-28476

CVE-2021-28476：vmswitch.sys 中的“Microsoft Hyper-V 远程代码执行漏洞” 这是 CVE-2021-28476（“Hyper-V 远程代码执行漏洞”）的概念验证，该漏洞是 vmswitch.sys（ 网络虚拟化服务提供程序 ）中的任意内存读取问题，微软于 2021 年 5 月进行了修补。 该漏洞由 @australeo、@ergot86、@peleghd 和 @OphirHarpaz 发现。客户虚拟机通过 VMBus（一种 用于分区间通信的基于通道的通信机制 ）发送恶意 RNDIS 数据包即可触发该漏洞。 以下是主机 系统在调试器中崩溃时的样子：...

AZL-102971 CVE-2026-90097 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition The VMBus module initialization function, hvacpiinit, currently does nothing when running in the root partition and root is not nested in another VM. But...

0vercl0k

0vercl0k PoC para CVE-2021-28476, una "vulnerabilidad de ejecución remota de código" de invitado a host en vmswitch.sys...

CVE-2021-28476

CVE-2021-28476: Desreferencia de puntero arbitrario en Hyper-V vmswitch.sys desde una VM invitada Resumen: Una máquina virtual invitada de Hyper-V puede desencadenar una condición de Denegación de Servicio en su host subyacente debido al análisis inseguro de entrada por parte de la función...

AZL-101225 CVE-2026-89927 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Fix an issue where userspace or the guest can program an Hyper-V synthetic timer to have a deadline in the past via integer overflow, preventing the CPU from making...

DEBIAN-CVE-2026-89927

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Fix an issue where userspace or the guest can program an Hyper-V synthetic timer to have a deadline in the past via integer overflow, preventing the CPU from making...

CVE-2021-28476-tools-env

来自 bluefrostsecurity 研究人员的 POC CVE-2021-28476 打包测试与漏洞利用开发 安装指南： root@kitploit: cd tools/ ./addtopathtools.sh addition tools for /usr/bin/ remove tools from /usr/bin: cd tools/ ./deltopathtools.sh 工具： pocinit: 描述： 为编译 POC 预初始化 guest host 环境（参见 poccompile） 命令参数： arg1：CVE 根目录路径 执行选项： 以 root 身份运行...

CVE-2026-89927 KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Fix an issue where userspace or the guest can program an Hyper-V synthetic timer to have a deadline in the past via integer overflow, preventing the CPU from making...

CVE-2025-21333

CVE-2025-21333 Desbordamiento de montón Paged Pool en Hyper-V NT Kernel Integration VSP vkrnlintvsp.sys → escalada de privilegios local LPE. Este directorio contiene el código fuente del PoC de laboratorio basado en MrAle98/CVE-2025-21333-POC, con parches locales. 1. Resumen de la vulnerabilidad...

CVE-2023-36407

CVE-2023-36407 这是 CVE-2023-36407 的 PoC，Hyper-V 权限提升漏洞。 https://github.com/pwndorei/CVE-2023-36407/assets/96749184/a8ef87d3-e0d0-40e5-9b23-35ab057a9c78 漏洞 通过 winhvr.sys!WinHvGet/SetVpState 对非分页池进行越界读/写 复现步骤 使用的环境：Windows 11 22H2 x64 补丁：kb5031354 WinHvSetVpState 的控制代码：0x221268 如果 PoC 不起作用，请分析 Vid.s...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them as SCSI devices in a guest VM. I/O to the vFC device is handled by the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clocksource: hyper-v: unexport init-annotated hvinitclocksource EXPORTSYMBOL and init are a poor combination, as the .init.text section is freed after initialization. As a result, modules cannot use symbols annotated with init...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: storvsc: Fixed scheduling while atomic on PREEMPTRT This resolved the issue of lock-up and other problems that occurred when running with PREEMPTRT enabled on Hyper-V: 415.140818 BUG: Scheduling while atomic:...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: x86/hyperv: Fixed a NULL dereferencing in sethvtscchangecb if the Hyper-V setup fails. Checked for a valid hvvpindex array before dereferencing hvvpindex when setting Hyper-V’s TSC change callback. If Hyper-V setup fails in...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Do not dereference the ACPI root object handle Since the commit referenced in the Fixes section below the VMBus client driver attempts to traverse the ACPI namespace from the VMBus ACPI device to the ACPI...