hbp-attack-demo

fork from https://github.com/veritas501/hbpattackdemo hbpattack demo Reference: P0 blog: https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html Created a vuln module, pretending we have a kernel arbitrary address write primitive, but KASLR is...

CVE-2026-89616

A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the nireadframe function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used kernel memory pages to a local attacker who reads a specially...

iOS26.6-CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...

cve-2022-4543-wrapper

cve-2022-4543-wrapper Introduction This is a wrapper of willsroot's CVE-2022-4543 exploit to help you judge and get kernel base address. How to use Compile Base on your demandOptional: root@kitploit: gcc dekaslr.c --static -o dekaslr g++ main.cpp --static -o main For some OS, install static libc...

CVE-2026-43499-S25U

CVE-2026-43499 PoC para Galaxy S25 Ultra Prueba de concepto específica del dispositivo para CVE-2026-43499 en el Samsung Galaxy S25 Ultra coreano. Objetivo compatible root@kitploit: Model: SM-S938N Codename: pa3q Android: 16 / API 36 Build: S938NKSUACZF1 Display ID: BP4A.251205.006.S938NKSUACZF1...

exploiting-cve-2017-5123

Exploiting CVE-2017-5123 Introduction This repository is an addition to the article published in MISC Magazine 96. We achieved to elevate our privileges in a reliable way, on our virtual machine with SMEP / SMAP and KASLR enabled. It should however be noted that the system if left in an unstable...

CVE-2026-89616

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

x18-leak

x18-leak iOS 11.2 introduced a kernel information leak that could be used to determine the kASLR slide. The issue was the result of a newly added feature, ARMKERNELPROTECT, that inadvertently caused the address of the kernel function Lel0synchronousvector64long to appear in register x18 when...

CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

EUVD-2026-76528

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616

CVE-2026-89616 is an information leak in the Linux kernel fs/ntfs3 driver. In ni_read_frame() , the LZNT decompression of a $DATA frame can terminate early when the compressed stream is exhausted (e.g., a zero chunk header), returning a byte count far less than frame_size . The bytes between the ...

CVE-2017-16994

/ disablemapminadd.c / / / include include include include include include include / offsets might differ, kernel was custom compiled you can read vmlinux and caculate the offset when testing / / define OFFSETKERNELBASE 0x000000 / define MMAPMINADDR 0x1101de8 define DACMMAPMINADDR 0xe8e810 / get...

vpwn

vpwn by qwertyoruiop generic xnu heap overflow exploitation. demo output: $ ./pwn i Preparing payload... i broke out of kaslr, kaslrslide = 0000000001a00000 + Payload successfully crafted. i Manipulating the heap... i Exploit loaded. + got r00t sh-3.2 uname -a Darwin qwertyoruiops-iMac.local 14.3...

omae-wa-cheese-da

omae-wa-cheese-da Image GPU任意物理读写（CVE-2025-21479） - KASLR泄露 - SELinux宽容模式 - RKP安全的init-hook根服务器及DEFEX绕过自定义二进制执行（LDPRELOAD） 大约需要6分钟。请耐心等待。 稍后我会优化。 已测试设备 Galaxy Z Flip 5 SM-F731N 固件：F731NKSU5EYD9 Android：15 安全补丁：2025-04-01 SoC：Snapdragon 8 Gen 2 SM8550 / kalama GPU：Adreno 740 v2 Galaxy Z Flip 5...

CVE_2026_40369

CVE202640369 Exploit poc and exp for CVE202640369, related to my analyze, use cmake. Debug code, poc and exp files for reproducing CVE202640369, written with cmake. As before, you can compile it directly using the regular cmake commands. About the analysis article: WeChat Official Account:...

kernel-exploits

Linux 内核漏洞利用 日期| 链接| 描述| 攻击向量| 影响 ---|---|---|---|--- 02.2016| CVE-2016-2384| USB MIDI 驱动程序中的双重释放| USB + 本地| 本地权限提升 03.2016| prefetch-side-channel| 通过 prefetch 绕过 KASLR| 本地| 信息泄露 12.2016| CVE-2016-9793| 套接字缓冲区中的符号性问题| 本地 + capnetadmin| 本地权限提升 02.2017| CVE-2017-6074| DCCP 套接字中的双重释放| 本地| 本地权限提升...

exploit_linux_kernel4.13

This repo contains an old poc that combines three CVEs CVE-2017-14954, CVE-2017-18344, CVE-2017-5123. The poc is a Local Privilege Escalation for Linux Kernel 4.13 tested on Ubuntu. The exploit uses an info leak CVE-2017-14954 to bypass KASLR, an arbitrary read CVE-2017-18344 to read the kernel...

CVE-2022-25636-PipeVersion

CVE-2022-25636 pipe version Using pipe-primitive to exploit CVE-2022-25636, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive...

CVE-2021-22555-PipeVersion

CVE-2021-22555 pipe version Using pipe-primitive to exploit CVE-2021-22555, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive Tested on both Linux 4.15 and Linux 5.8...

kasld

KASLD 从本地进程恢复 Linux 内核的虚拟和物理内存布局——主要是内核代码基址——并尽可能利用该进程视角所允许的一切：其权限与能力、系统配置以及任何容器限制。在存在泄漏或侧信道的情况下，它直接恢复内核代码基址；否则，它将范围缩小到现有证据所支持的最小放置集合。推理引擎将来自数十种独立技术的证据与架构已知的不变量融合，将内核的放置范围缩小到一个残余窗口——以存留槽位数和熵位数报告：这是 KASLR 从此视角保留的保护的上界，而非保证基址在攻击者触及范围之外（参见 docs/limitations.md）。在完全修补的现代内核上——x86-64...