salt

Bienvenue dans salt , un outil pour rétroconcevoir et apprendre la gestion de la mémoire tas du noyau. Il peut être utile pour développer un exploit, déboguer votre propre code noyau et, plus important encore, pour jouer avec les allocations du tas du noyau et apprendre son fonctionnement interne...

ctl_ctloutput-leak

ctlctloutput-leak La fonction ctlctloutput de macOS High Sierra 10.13 ignore la valeur de retour d'un appel à sooptcopyin, ce qui ouvre une fenêtre de course pour divulguer des données non initialisées du tas noyau vers l'espace utilisateur. ctlctloutput-leak est un exploit de proof-of-concept qu...

CVE-2019-6207

CVE-2019-6207 getdirentriesattr 커널 힙 정보 누출 이 취약점은 macOS=10.14.4 &&ios 12.2의 샌드박스에서 트리거될 수 있습니다. 이 취약점에 대한 더 자세한 내용을 업데이트하겠습니다...

CVE-2019-6207

CVE-2019-6207 cette vulnérabilité peut être déclenchée en sandbox sur macOSwop == NETRTFLAGS || w-wop == NETRTFLAGSPRIV && !rt-rtflags & w-warg goto done; / If the matching route has RTFLLINFO set, then we can skip scrubbing the MAC only if the outgoing interface is no...

CVE_2025_24257----NOT-MINE

🔧 CVE202524257----NOT-MINE - Exécuter le PoC Windows en toute sécurité 🧾 Aperçu CVE202524257----NOT-MINE est une preuve de concept Windows qui montre un bogue mémoire noyau dans IOGPUFamily. Il repose sur un sous-dépassement de bitmapmask pouvant conduire à une écriture hors limites du tas noyau...

EUVD-2026-63810

Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could cause memory leak or double free even...

CVE-2026-45202

A flaw in Imagination GPU DDK's _FreeOSPages_Fast function fails to track state of upgraded higher-order CMA allocations, enabling a non-privileged user to trigger memory leaks or double frees via GPU syscalls, potentially causing kernel heap corruption. No exploit code or in-the-wild exploitatio...

EUVD-2026-63643

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read...

PT-2026-79296

Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption. Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could cause memory leak or double free even...

CVE-2026-17060

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read...

CVE-2026-17060

CVE-2026-17060 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 , where a kernel heap over-read allows a remote attacker to obtain sensitive information and cause a denial of service . The NVD rates this CVSS 9.1 (CRITICAL) with a network vector and no privileges required, while IBM's own scorin...

PT-2026-79179

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read...

CVE-2026-74498

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio subsystem. When a USB audio endpoint requests full packet transfers using the fillmax descriptor flag, the system allocates an undersized Direct Memory Access DMA buffer. This allows a malicious USB device to...

check_icmp_dos

checkicmpdos iOS 12 / OS X 원격 커널 힙 오버플로CVE-2018-4407 POC： root@kitploit: pip install scapy sudo scapy sendIPdst=“Target IP“,options=IPOption“A”8/TCPdport=2323,options=19, “1"18,19, “2”18 또는 스크립트 사용 root@kitploit: python checkicmpdos.py 127.0.0.1 이 취약점을 통해 공격자는 동일한 Wi-Fi 네트워크에 접속하기만 하면, 아무것도 모르는 다...

CVE-2026-58087

The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but t...

CVE-2026-58088

Affected: All supported FreeBSD versions. Root cause: A race condition in ELF core dump code — a second-pass write to the program-header buffer is not bounds-checked against the count from the first pass, so a process sharing the address space via rfork(2) can mutate the VM map between passes. Im...

EUVD-2026-62365

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...

CVE-2026-58088 Race condition in ELF core dump segment counting

The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes, causing the second...

PT-2026-78319

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The GETALL and SETALL commands in the semctl function contain a flaw in how they handle semaphore sets. The process records the number of semaphores, releases th...

PT-2026-78320

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A race condition exists in the ELF core dump code. The system counts dumpable VM map entries and allocates a buffer for program headers, then iterates over the m...