472526 matches found
kernel: vsock/virtio: bind uarg before filling zerocopy skb
A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...
kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker
A flaw was found in the Linux kernel's SUN Remote Procedure Call SUNRPC implementation. A use-after-free vulnerability exists in the Transport Layer Security TLS connection path. When a TLS handshake fails, the client resource can be prematurely freed, leading to a subsequent attempt to access th...
kernel: vsock/vmci: fix UAF when peer resets connection during handshake
A flaw was found in the vsock/vmci component of the Linux kernel. A remote attacker could exploit a Use-After-Free UAF vulnerability when a peer resets a connection during the handshake process. This occurs because the system incorrectly handles reset packets, leading to a pending socket being le...
kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF
A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...
kernel: igc: set tx buffer type for SMD frames
A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...
kernel: nfsd: initialize copy-notify stateid before publishing it
A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOADCANCEL operation, leading to a race condition that...
kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
A flaw was found in the Linux kernel's Intel Ethernet controller driver idpf. This vulnerability occurs because a critical synchronization mechanism, known as a spinlock, is accessed before it has been properly initialized. An attacker could potentially exploit this timing issue to cause the syst...
qu1ckr00t
qu1ckr00t Android 커널 임의 읽기/쓰기CVE-2019-2215의 위력을 보여주는 PoC 애플리케이션입니다. Writeup: https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ Qu1ckR00t는 개념 증명PROOF OF CONCEPT용입니다. 소중한 사용자 데이터가 있는 개인 기기에서 사용해서는 안 됩니다. Pixel 2에서만 테스트되었습니다. 다른 기기/커널에서 실행하면 충돌이나 데이터 손실이 발생할 수 있습니다. 메시지가...
Kernel-Exploits
カーネルエクスプロイト カーネルエクスプロイト用リポジトリ...
encrypted-linux-kernel-modules
ELKM: 암호화된 Linux x86-64 로더블 커널 모듈 ELKM은 암호화된 로더블 커널 모듈LKM을 안전하게 전송하고 로드할 수 있는 메커니즘을 제공합니다. 목표는 엔드포인트 탐지 및 대응EDR 소프트웨어의 관찰로부터 커널 기반 루트킷과 임플란트를 보호하고, 디스크 포렌식 도구에 의한 복구 효과를 무력화하는 것입니다. RHEL/CentOS 7 ELKM은 RHEL/CentOS 7 x86-64용으로 특별히 작성되었습니다. kernel-tools-libs-3.10.0-1127.18.2.el7.x8664...
iqvw64e-privilege-escalation
iqvw64e-privilege-escalation CVE-2015-2291 로컬 권한 상승 PoC 개요 이 프로젝트는 드라이버 iqvw64e.sys SHA256: 37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9 — 즉 CVE-2015-2291 과 관련된 Intel 이더넷 진단 드라이버 — 의 로컬 권한 상승LPE 취약점에 대한 교육용 개념 증명PoC입니다. KDMapper 같은 커널 모드 로더에서 이 드라이버가 악용되는 것을 본 후, IOCTL 디스패치가 어...
kernel: nfsd: fix UAF in async copy cancel and shutdown
A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
kernel: nfsd: revoke copy-notify stateids before dropping their reference
A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading t...
kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker
A flaw was found in the Linux kernel's SUN Remote Procedure Call SUNRPC implementation. A use-after-free vulnerability exists in the Transport Layer Security TLS connection path. When a TLS handshake fails, the client resource can be prematurely freed, leading to a subsequent attempt to access th...
kernel: vsock/virtio: fix zerocopy completion for multi-skb sends
A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers skbs. An issue in how user arguments uargs are handled for these buffers can lead to pinned user pages not being...
kernel: vsock/virtio: bind uarg before filling zerocopy skb
A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...
kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
A flaw was found in the Linux kernel's Network File System Daemon nfsd component. When performing an asynchronous async copy operation, a programming error causes a stale identifier IDR entry to point to memory that has already been reused. This can lead to memory corruption, where the system...
kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF
A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...
kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem, specifically within the SEV Secure Encrypted Virtualization feature. A malicious guest operating system utilizing SEV-SNP Secure Nested Paging can exploit an out-of-bounds write vulnerability due to improper...