CVE-2024-26160

CVE-2024-26160（cldflt.sys 信息泄露漏洞） 这里有一篇关于 CVE-2024-26160 的简短分析，该漏洞可在二月补丁（KB5034765 ，Windows 11 22H2、Windows 11 23H2）中找到。该漏洞已在三月补丁（KB5035853 ）中修复。 分析 该漏洞位于 CldiPortProcessGetRangeInfo 函数中，它没有 检查用户应用程序传入的缓冲区大小。由于该大小可由用户控制，memmove（用于复制返回的信息）在正确传入大小的情况下，可以获取包含内核地址的相邻内存池。 三月补丁（KB5035853 ）引入了对缓冲区大小的额外检...

CVE-2023-26083

CVE-2023-26083 – タイムラインストリームを介したMali GPUカーネルアドレス漏洩 このリポジトリには、CVE-2023-26083 の概念実証（PoC）エクスプロイトが含まれています。これはMali GPUドライバ（Arm Mali GPU Kernel Driver）の脆弱性であり、特権のないユーザーがタイムラインストリーム（/dev/mali0）を介してカーネルポインタや機密内部情報を漏洩することを可能にします。 脆弱性の概要 Mali...

CVE-2026-43499-OnePlus15

CVE-2026-43499 — OnePlus 15 LPE（教育用PoC） 警告： このリポジトリは教育および研究目的のみ で提供されています。 ビルド済みのバイナリやリリースは配布されていません。すべてソースからビルドする必要があります。 OnePlus 15向けのAndroid 16ローカル権限昇格。 kallsymsアライメント修正と確認済みOnePlus 15プロファイルを含むx-spy/CVE-2026-43499-popsicleのフォーク。 プロファイル...

CVE-2023-2598

CVE-2023-2598 参考： https://anatomic.rip/cve-2023-2598/ https://github.com/ysanatomic/iouringLPE-CVE-2023-2598 https://bsauce.github.io/2024/07/30/CVE-2023-2598/ 构建： root@kitploit: apt install -y liburing-dev gcc CVE-2023-2598.c -o CVE-2023-2598 -luring PoC： root@kitploit: user1@syzkaller:$ uname -...

CVE-2026-80602 perf/x86/amd/lbr: Fix kernel address leakage

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...

CVE-2026-80602

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...

CVE-2025-24990_POC

Windows Agere Modem Driver ltmdm64.sys. Questo driver è molto vecchio e non viene caricato di default sulla mia macchina di test, quindi lo sfrutterò in uno scenario BYOVD. Curiosamente, secondo le mie ricerche questo driver esisteva su Windows 7 e ha almeno un bug. qui A quel tempo, MSRC non ha...

EtwLeakKernel

EtwLeakKernel Questo repository contiene un PoC per un programma che utilizza ETW per far trapelare indirizzi di memoria del kernel. Lo fa creando un consumer potenzialmente verso quasi qualsiasi provider, dato che quasi tutti fanno trapelare indirizzi del kernel e richiedendo uno stack trace. Un...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/siw: Fixed a potential NULL pointer dereference during header processing. If siwgethdr returns -EINVAL before setrxfpducontext, qp-rxfpdu can be NULL. The error path in siwtcprxdata dereferences qp-rxfpdu-moreddpsegs...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: BPF: Use VMMAP instead of VMALLOC for the ringbuf area. After the commit 2fd3fb0be1d1 “kasan, vmalloc: unpoison VMALLOC pages after mapping”, non-VMALLOC mappings will be marked as accessible in getvmareanode when KASAN is enable...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: dm raid: fixed the KASAN warning in raid5adddisks. There is a KASAN warning in raid5adddisk when running the LVM testsuite. The warning occurs during the test lvconvert-raid-reshape-lineartoraid6-single-type.sh. We fixed this...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvmet-tcp: bounds checks were added in nvmettcpbuildpduiovec. The nvmettcpbuildpduiovec function could exceed the range of cmd-req.sg when the length or offset of the PDU exceeds sgcnt. As a result, it might use bogus values f...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Avoid invalid reads in irdmanetevent. The irdmanetevent function should not dereference anything from “neigh” alias “ptr” until it has checked that the event is of type NETEVENTNEIGHUPDATE. Other events are pointed to...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Disabling KASAN during applyalternatives Fei has reported that KASAN is triggered during applyalternatives on a 5-level paging machine: BUG: KASAN: Out-of-bounds access in rcuiswatching Reading of a 4-byte value...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Allocate sufficient space for GMU registers In commit 142639a52a01 “drm/msm/a6xx: fix crashstate capture for A650”, we changed a6xxgetgmuregisters to read 3 sets of registers. Unfortunately, we did not change the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: Endpoint – Fix for handling the configfs group list head The use of listdel on the epfgroup field of struct pciepfdriver in pciepfremovecfs is incorrect. This field is a list head, not a list entry. This listdel call trigger...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fixed invalid address access in lookuprec when the index is 0. KASAN reported the following issue: BUG: KASAN: use-after-free in lookuprec A read of size 8 at the address ffff000199270ff0 was performed by the task modprob...

CVE-2026-72237

A flaw was found in the Linux kernel. A local user can exploit a vulnerability in the perf subsystem on AMD processors utilizing the Branch Sampling BRS feature. This flaw occurs because the software filtering mechanism for branch records only validates the branch-to address, leaving the...

CVE-2026-74339

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read sndseqread copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRVSEQEXTCHAINED internally, and data.ext.ptr...

CVE-2026-72402

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs printbpfinsn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPFPSEUDOMAPFD and BPFPSEUDOMAPVALUE...