nullmap

nullmap 一个非常简单的驱动手动映射器，基于我早期的 voidmap 和 CVE-2023-21768 POC，由 chompie 和 b33f 完成。由于底层 IoRing 后利用内存读/写原语无法很好地处理大量连续的读取和写入，我决定覆写 CR4 来禁用 SMEP/SMAP，以执行映射到用户态的驱动。已在 Windows 11 22H2 22621.525 上测试。 用法： nullmap.exe 可能的问题： 手动映射的驱动会位于由 ExAllocatePool 分配的内存池中。如果你想将其用于更严肃的目的，应该考虑寻找更好的内存分配方式，使其不易被转储。...

Recreate-cve-2023-21768

产生原因：对比202209和202307的AFD.sys,在函数AfdNotifyRemoveIOCompletion中，202209版的windows和202307版的windows都有一步用ProbeForWrite函数检测一段内存区域是否在用户态，但是检测的buffer地址有0x8字节的不同，而在该漏洞patch之前，没有该检查，可以猜测202209版的buffer的检查地址可能不太正确而可能无效，而该检查的buffer与中间一步赋值有关：DWORD a3 + 24 = v20;其中应该检查的buffer是a3+24,而v20的值与v8 =...

CVE-2025-21333

CVE-2025-21333 你可以在 https://github.com/MrAle98/CVE-2025-21333-POC/tree/master 找到此CVE的第一个版本利用程序。我受MrAle98所做利用程序的启发制作了这个新的利用程序。 它更稳定，而且很少出问题，因为它不需要打开 Windows 沙盒进程来获取 GUID。我使用了 Microsoft Defender 应用程序防护（MDAG）API 来获取沙盒进程的 GUID。 注意 我尝试了使用 MrAle98 使用的 IoRing 喷射方法，在完成 IoRing 的初始设置后一次性调用...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004033)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004033 advisory. An issue was discovered in domadvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORINGOPMADVISE...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001672)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001672 advisory. A time-of-check to time-of-use issue exists in iouring subsystem's IORINGOPCLOSE operation in the Linux kernel's versions 5.6 - 5.11 inclusive, which allows a local...

OESA-2025-1285 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: IORINGOPREAD did not correctly consume the provided buffer list when read i/o returned 0 except for -EAGAIN and -EIOCBQUEUED return. This can lead to a potential...

Linux Distros Unpatched Vulnerability : CVE-2023-52926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - IORINGOPREAD did not correctly consume the provided buffer list when read i/o returned 0 except for -EAGAIN and -EIOCBQUEUED return. This can lead to a potentia...

UBUNTU-CVE-2023-52926

In the Linux kernel, the following vulnerability has been resolved: IORINGOPREAD did not correctly consume the provided buffer list when read i/o returned 0 except for -EAGAIN and -EIOCBQUEUED return. This can lead to a potential use-after-free when the completion via iorwdone runs at separate...

PT-2025-6059 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue arises when IORING REGISTER CLONE BUFFERS is used to clone buffers from one uring instance to another, where the two instances use different memory managers MMs for accountin...

UBUNTU-CVE-2023-1032

The Linux kernel iouring IORINGOPSOCKET operation contained a double free in function syssocketfile in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067...

Linux kernel 资源管理错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from incorrect manipulation of iouring and IORINGOPSPLICE, resulting in memory reuse after release...

Linux kernel 竞争条件问题漏洞

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A competitive condition vulnerability exists in domadvise in mm/madvise.c in Linux kernel versions prior to 5.6.8. Th...

PT-2020-4973 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.6.8 Description: The issue is related to a race condition between coredump operations and the IORING OP MADVISE implementation in the do madvise function of the Linux kernel. This condition may allow an attack...