CVE-2024-38041

CVE-2024-38041 Kernel pointers copied to output user mode buffer with ioctl 0x22A014 in the appid.sys driver...

CVE-2022-2078

CVE-2022-2078 root@kitploit: $ ./poc ... + getset leakbuffer: 0000 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;? 0010 28 00 00 00 00 02 0a 8f 68 8b a2 be 40 ac 70 8c [email protected]. 0020 ff ff ff ff 00 6c b5 81 .....l.. + kernel=0xffffffff8c70ac40...

iOS26.6-CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB 읽기 KASLR 무력화 구성 요소: AppleKeyStore 커널 확장 — LibSerSEPControlDeserialize 영향: iOS / iPadOS 26.6 23G71 및 이전 버전 수정 버전: iOS / iPadOS 26.6.1 23G83 유형: SEP 제어 메시지 역직렬화 과정의 Out-of-Bounds 읽기 영향: 커널 포인터 유출 → 샌드박스 및 자격entitlement 없는 프로세스에서 KASLR 무력화 DYLDINTERPOSE ACM 핸들 캡처 경...

CVE-2026-57843 NetBSD mm_open() PK_KMEM Flag Kernel Pointer Information Disclosure

NetBSD contains an information disclosure vulnerability in mmopen within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PKKMEM process flag. Attackers can...

CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB 읽기 KASLR 무력화 구성 요소: AppleKeyStore 커널 확장 — LibSerSEPControlDeserialize 영향: iOS / iPadOS 26.6 23G71 및 이전 버전 수정 버전: iOS / iPadOS 26.6.1 23G83 유형: SEP 제어 메시지 역직렬화 과정의 경계를 벗어난 읽기Out-of-Bounds read 영향: 커널 포인터 유출 → 샌드박스 및 자격entitlement이 없는 프로세스에서 KASLR 무력화 DYLDINTERPOS...

CVE-2026-80918 HID: core: fix number/pointer type confusion on long items

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...

CVE-2026-20805-PoC

CVE-2026-20805 PoC Microsoft Desktop Window Managerdwm.exe의 정보 노출 취약점을 입증하는 개념 증명PoC입니다. 개요 이 저장소에는 Windows Desktop Window Manager 프로세스에 영향을 미치는 정보 노출 취약점인 CVE-2026-20805를 재현하기 위해 개발된 맞춤형 개념 증명PoC이 포함되어 있습니다. 이 취약점은 ALPC 관련 구조체의 부적절한 처리로 인해 로컬 인증 사용자가 커널 객체 포인터를 유출할 수 있게 하며, 잠재적으로 KASLR커널 주소 공간...

IPC-Memory-Mac-OSX-Exploit

IPC-Memory-Mac-OSX-Exploit IPC 로컬 보안 우회 공유 메모리를 통한 프로세스 간 통신IPC은 두 개 이상의 프로세스가 공통 메모리에 접근할 수 있는 개념입니다. 통신은 이 공유 메모리를 통해 이루어지며, 한 프로세스가 변경한 내용을 다른 프로세스가 볼 수 있습니다. Apple OS X 10.9.2까지의 커널은 XNU 객체 데이터 구조에 커널 포인터를 배치하며, 이 구조는 사용자 공간에서 접근 가능합니다. 이로 인해 로컬 사용자가 객체의 지정되지 않은 속성을 읽어 ASLR 보호 메커니즘을 더 쉽게 우회할 ...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: 데스크톱 힙에 하나의 QWORD가 너무 많음 Windows 11 Insider 빌드 10.0.28020.2149에서 Win32k 데스크톱 힙의 사용자 모드 매핑이 오프셋 0x100에 원시 커널 세션 풀 포인터를 노출했습니다. 읽기 자체는 거의 공격적으로 작을 정도입니다: root@kitploit: ULONG64 leaked = ULONG64 desktopheap + 0x100; 테스트 세션에서 다음 값이 반환되었습니다: root@kitploit: 0xffffc600dcc00040 이 값은 동일한...

CVE-2026-74665

A flaw was found in the Linux kernel. Incorrect length accounting for skb socket buffer fragments after an eXpress Data Path XDP program adjusts the fragment area can lead to an out-of-bounds read. This allows an attacker to potentially disclose sensitive kernel pointers and corrupt user-space...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed incorrect reg type conversion in releasereference Some helper functions will allocate memory. To avoid memory leaks, the verifier requires the eBPF program to release this memory by calling the corresponding helper...

SUSE CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

SUSE CVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

UBUNTU-CVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

UBUNTU-CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74665 net: fix skb length accounting after generic XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74665

CVE-2026-74665 affects the Linux kernel 's generic XDP (eXpress Data Path) path. When an XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() updates skb->data_len but leaves skb->len with the old fragment contribution. After a fragment shrink, skb_headlen() becomes larger than...