dr_checker

DR.CHECKER : Linux 커널 드라이버를 위한 건전성 취약점 탐지 도구 이 저장소는 설정 스크립트를 포함한 모든 소스를 포함합니다. 이제 경고와 해당 소스 파일을 함께 볼 수 있는 멋진 UI를 제공합니다. 테스트 환경 Ubuntu = 14.04.5 LTS 공지사항 2018년 2월 16일 : DR.CHECKER가 도커화되었습니다. 사용 방법은 Docker 사용법을 참조하세요. 자주 묻는 질문 0. 도커화된 설정 사용 권장 미리 빌드된 도커 컨테이너에서 DR.CHECKER를 사용하는 방법에 대한 자세한 내용은 Docker...

dr_checker

DR.CHECKER : A Soundy Vulnerability Detection Tool for Linux Kernel Drivers This repo contains all the sources, including setup scripts. Now with an Amazing UI to view the warnings along with corresponding source files. Tested on Ubuntu = 14.04.5 LTS Announcements 16 Feb 2018 : DR.CHECKER has bee...

masm32-kernel-programming

masm32-kernel-programming Dreg가 자신의 필요에 따라 관리하는 저장소입니다. masm32 커널 프로그래밍, 드라이버, 튜토리얼, 예제, 도구크레딧: Four-F Instructions 이 저장소를 다운로드/클론하세요 masm32v11rinstall.exe를 실행하세요 설치 이미지지구본를 클릭하세요 masm32를 C:\에 설치하세요 PATH 환경 변수에 다음 항목을 추가하는 것을 권장합니다: C:\masm32\bin C:\masm32 KmdKit18\include\ 내용을 C:\masm32\include\...

siem

Offensive SIEM SIEM을 공격적 발견 도구로 활용하는 실용적인 기법으로, 방어자가 공격자처럼 사고하여 내부에서 보안을 강화할 수 있도록 돕습니다. 쿼리 위 참조 - queries.md 파일. 필요할 때 계속 업데이트할 예정입니다. 아이디어는 서로 다른 event.codes/event.providers를 사용하여 레이어별로 커버리지를 확보하는 것입니다. 2026년 2월에 환경 PATHS, 커널 드라이버 및 로그온/시작 스크립트 등에 대한 쿼리를 공개했습니다! 2026년 3월에 OpenSSL 라이브러리 및 바이너리 경...

USN-8662-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - Cryptographic API; - InfiniBand drivers; - Media drivers; - STMicroelectronics network drivers;...

Linux Distros Unpatched Vulnerability : CVE-2026-72483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In the...

USN-8630-2: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Mellanox network drivers; - File systems infrastructur...

USN-8636-1 linux-azure-6.17, linux-gcp-6.17, linux-hwe-6.17, linux-oem-6.17, linux-realtime-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Media drivers; - Network drivers; - Mellanox network drivers; - Texas...

Linux Distros Unpatched Vulnerability : CVE-2026-68303

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use devgetdrvdatamaster in their unbind functions. Since the vc4-drm gets removed befor...

CVE-2026-50393

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

PT-2026-51192

Name of the Vulnerable Software and Affected Versions EaseUS Partition Master versions prior to 14.6 Description A security flaw exists in the Kernel Driver component within the EUEDKEPM.sys library. An unknown function in this library allows for improper access controls, which can be exploited b...

PT-2026-51191

Name of the Vulnerable Software and Affected Versions EaseUS Partition Master versions prior to 14.5 Description An issue exists in the Kernel Driver component within the epmntdrv.sys library. A local attacker can manipulate an unknown function to cause improper access controls, which occurs when...

PT-2026-51193

Name of the Vulnerable Software and Affected Versions IM-Magic Partition Resizer versions prior to 7.9.0 Description Improper access controls in the Kernel Driver component, specifically within the MDA NTDRV.sys library, allow for local privilege escalation. This issue occurs when a local attacke...

PT-2026-51194

Name of the Vulnerable Software and Affected Versions Ezbsystems UltraISO Premium Edition versions prior to 9.77 Description Improper access controls exist within the Kernel Driver component, specifically affecting the bootpt64.sys library. This issue allows for unauthorized access when manipulat...

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have flagged two previously undocumented Windows variants of what was believed to be a Linux-only backdoor called SprySOCKS. "The Windows variants discovered are internally marked as WINDRV and WINPLUS," ESET said in a report shared with The Hacker News. "Both come with ...

CVE-2026-45600

Access of resource using incompatible type 'type confusion' in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

CVE-2026-45600

Access of resource using incompatible type 'type confusion' in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

CVE-2026-45600

CVE-2026-45600 describes a type confusion in Windows kernel-mode drivers that allows an authorized, local attacker with low privileges and no user interaction to elevate privileges. The CVSS v3.1 score is 7.8 (High) with local attack vector, low attack complexity, and impacts to confidentiality, ...

PT-2026-47989

Access of resource using incompatible type 'type confusion' in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective

1 Introduction This article provides a technical analysis of how many Windows kernel mode drivers can be interacted with from user mode without the hardware they were developed for. This work was motivated by driver-oriented vulnerability research and the need to evaluate the exploitability of...