CVE-2024-26817-amdkfd

-- CVE-2024-26817 我在 AMD KFD 中发现了一个安全漏洞，位于文件 drivers/gpu/drm/amd/amdkfd/kfdchardev.c 中，ioctl 标识符为 AMDKFDIOCGETPROCESSAPERTURESNEW。 在函数 kfdioctlgetprocessaperturesnew 中，用户提供的 args-numofnodes 数据会被进行乘法运算，然后直接传递给 kzalloc，这可能导致在某些平台上发生整数溢出。 这会分配一个较小的内存空间，并可能在同一个函数中紧随其后破坏堆。 描述 在 Linux 内核中，已修复以下漏洞：...

CVE-2014-0075_PoC

CVE-2014-0075PoC 这是一个简单的用Python编写的PoC，演示了通过整数溢出导致的DoS攻击。...

CVE-2026-107614

An integer underflow in WinCursorShapeUtils::trimTransparent in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI...

CVE-2023-6931

CVE-2023-6931 PoC de Kernel Panic para CVE-2023-6931 Descripción CVE-2023-6931 es una vulnerabilidad en perfevent que conduce a un desbordamiento de búfer en el heap causado por un desbordamiento de enteros en el readsize de un grupo. ¿Qué es un Evento de Rendimiento perf event? perfevents es un...

EUVD-2026-95022

Dislocker through 0.7.3 contains an integer underflow vulnerability in getvmk and getfvek that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datumsize smaller than the 36-byte AES-CCM header, causing...

CVE-2026-107635 Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK Datum Size Underflow

Dislocker through 0.7.3 contains an integer underflow vulnerability in getvmk and getfvek that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datumsize smaller than the 36-byte AES-CCM header, causing...

CVE-2026-107635 Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK Datum Size Underflow

Dislocker through 0.7.3 contains an integer underflow vulnerability in getvmk and getfvek that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datumsize smaller than the 36-byte AES-CCM header, causing...

CVE-2026-107635

Dislocker versions through 0.7.3 are vulnerable to an integer underflow within the get_vmk() and get_fvek() functions. An attacker can provide a malicious BitLocker volume image with a datum_size smaller than the required 36-byte AES-CCM header, triggering an out-of-bounds heap read via the hexdu...

CVE-2026-107635

Dislocker through 0.7.3 contains an integer underflow vulnerability in getvmk and getfvek that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datumsize smaller than the 36-byte AES-CCM header, causing...

EUVD-2026-94978

An integer underflow in WinCursorShapeUtils::trimTransparent in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI...

CVE-2026-107614

GlavSoft TightVNC Server for Windows versions before 2.8.88 are vulnerable to an integer underflow in the WinCursorShapeUtils::trimTransparent() function. When a cursor shape with a width or height of zero is processed on the DXGI capture path , the loop bound width - 1 wraps to 0xFFFFFFFF. This ...

CVE-2025-66628

CVE-2025-66628: ImageMagick TIM解析器中的整数溢出 属性| 详情 ---|--- CVE编号| CVE-2025-66628 厂商| ImageMagick Studio LLC 产品| ImageMagick 受影响版本| 7.1.2-10 修复版本| 7.1.2-10 漏洞类型| CWE-190 整数溢出 CVSS v3.1评分| 7.5 高 CVSS向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 研究人员| Sumit Shah 摘要 ImageMagick 的 coders/tim.c 中的...

CVE-2025-47987

CVE-2025-47987: Windows CredSSP 权限提升 📌 本仓库包含关于 CVE-2025-47987 漏洞的分析文档和资源，该漏洞是一个影响 Windows Credential Security Support Provider CredSSP 协议的堆缓冲区溢出 Heap-based Buffer Overflow 缺陷。 📝 描述 该漏洞允许经过身份验证的本地攻击者提升系统权限。该缺陷源于在处理特定 CredSSP 协议数据包时内存管理不当，可能导致： 一个堆缓冲区溢出 或一个整数溢出 Integer Overflow 标识符: CVE-2025-47987...

CVE-2025-0690

CVE-2025-0690: GRUB2 整数溢出漏洞 🛡️ 概述 CVE-2025-0690 是引导加载程序 GRUB2 中的一个 整数溢出 关键漏洞，允许 任意代码执行 和 绕过 Secure Boot 。该缺陷影响依赖 GRUB2 进行安全启动的系统，在操作系统启动前暴露系统。 🔍 技术细节 根本原因 易受攻击的命令 ：read（用于接收键盘输入）。 问题 ：输入长度存储在一个 32 位整数 中。 利用机制 ： 输入极长的文本行。 导致长度变量 溢出 。 进而导致基于 堆 的缓冲区发生 越界写入（out-of-bounds write） 。 后果 破坏 GRUB2 内部关键数据 。...

CVE-2026-98176

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. An integer underflow vulnerability during the calculation of the End of Pipe EOP ring buffer size can lead to improper hardware queue configuration. A local user could potentially exploit this issue to cause system instability, resulti...

CVE-2026-98365

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA software driver. An unauthenticated remote attacker can cause a Denial of Service DoS or out-of-bounds memory access by sending specially crafted network requests that trigger an integer overflow during memory range validatio...

CVE-2026-93019

A signed integer conversion flaw was found in the Perl Imager library's TGA file reader. The colourmaplength field in the TGA header is declared as a signed short int. A TGA file with a colour map length of 32768 or greater causes the value to become negative, which sign-extends to a value near...

PoC-CVE-2022-26809

PoC-CVE-2022-26809 PoC para CVE-2022-26809, el análisis y las consideraciones se muestran en github.io. El PoC se ha escrito sobrescribiendo funciones de Impacket. Probado con: impacket versión 0.10.0 El PoC no se ha probado completamente, porque debería desencadenar la vulnerabilidad, es decir, ...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...