salt

Welcome to salt , a tool to reverse and learn kernel heap memory management. It can be useful to develop an exploit, to debug your own kernel code, and, more importantly, to play with the kernel heap allocations and learn its inner workings. This tool helps tracing allocations and the current sta...

CVE-2022-0492-Checker

CVE-2022-0492-Checker A script to check if a container environment is vulnerable to container escapes via CVE-2022-0492 About the vulnerability On Feb. 4 , Linux announced CVE-2022-0492 , a new privilege escalation vulnerability in the kernel. CVE-2022-0492 marks a logical bug in control groups...

device_renesas_kernel_AOSP10_r33_CVE-2022-0492

Linux kernel There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first. In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentatio...

CVE-2017-2370

0x00. Introduction This privilege escalation exploits a vulnerability in machvoucherextractattrrecipetrap, and the core of the exploitation method is through MACHMSGOOLPORTSDESCRIPTOR messages. Regarding machmsg ool, simply put, when sending an msg containing an ool descriptor, the kernel copies...

CVE-2024-20698

CVE-2024-20698 About this vulnerability: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20698 Analysis of the patch In the ntoskrnl.exe we have two patched functions: sub1406AE224 and WbAddLookupEntryEx. The vulnerable function is WbAddLookupEntryEx. Paths to this function: To cal...

CVE-2018-4407

CVE-2018-4407 CVE-2018-4407 is a buffer overflow vulnerability in the XNU kernel's ICMP error code. It causes IOS devices to crash both laptops and mobiles upon receival of one yes 1! single bad packet. The bug was originally disclosured by Kevin Backhouse on his lgtm blogpost on October 30th 201...

linux-4.1.15_CVE-2022-3564

Linux kernel release 4.x http://kernel.org/ These are the release notes for Linux version 4. Read them carefully, as they tell you what this is all about, explain how to install the kernel, and what to do if something goes wrong. WHAT IS LINUX? Linux is a clone of the operating system Unix, writt...

CVE-2026-43499-aristotle-apk

Aristotle ADB Enable 개발자 옵션에 접근할 수 없는 au/KDDI Xiaomi "aristotle"XIG04, Android 12 기기에서 CVE-2026-43499 로 얻은 임시 루트를 사용하여 ADB 를 켜는 최소한의 Android 앱입니다. KingRoot와 같은 범주의 기기 소유자 도구로, 자신의 휴대폰을 루팅하여 설정 하나를 변경합니다. 범위: 다음 펌웨어를 실행하는 본인의 XIG04 Xiaomi/XIG04jpkdi/XIG04:12/SP1A.210812.016/V14.0.3.0.TMFJPKD. 범용 또...

CVE-2014-3153

CVE-2014-3153 ubuntu 14.04 64-bit 3.13.0-24-generic...

CVE-2024-1086-Exploit

🔒 CVE-2024-1086 Exploit Project 🛡️ Polished educational Linux kernel exploit for security research This project provides a robust, non-functional template for studying CVE-2024-1086, a use-after-free vulnerability in the Linux kernel's netfilter: nftables component, enabling local privilege...

CVE-2018-4407

CVE-2018-4407 IOS/macOS kernel crash Usage: python CVE20184407.py IP/CIDR python CVE-20184407.py 192.168.1.1 python CVE20184407.py 192.168.1.0/24 1. find iphone nmap -sS -p 62078 --open 192.168.1.0/24 2. attack python CVE20184407.py iphoneip...

CVE-2021-3490

The eBPF ALU32 bounds tracking for bitwise ops AND, OR and XOR in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. Compile: gcc -o pwn pwn.c && gcc -o exploit exploit.c...

VortexCry-Ransomware-Release

VortexCry-Ransomware VortexCry is an advanced ransomware that utilizes multi-stage process injection such as Process Hollowing and APC Injection and kernel driver loading via the CVE-2019-16098 vulnerability. It is capable of encrypting files, destroying system recovery functionalities, and...

AFD

AFD CVE-2022-24494 The vulnerability is an arbitrary memory read. The root cause is a lack of validation in a memory address suplied from user-land that is used in a memcpy operation in order to copy data from this memory address into the pool memory. The lack of check is in the addres...

SecDrvPoolLeak

SecDrvPoolLeak - A PoC for CVE-2018-7250 Description An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. An uninitialized kernel pool allocation in IOCTL 0xCA002813 allows a...

exploit_mitigations

Exploitation Mitigations The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place. An example is the...

Intel-CVE-2015-2291

Intel-CVE-2015-2291 PoC exploit for CVE-2015-2291 Data-only attack to pop a system shell with the vulnerable intel driver. The code itselfs implements more "functionality" provided from the driver, like physical to virtual address translation, mapping physical memory This two combined = arbitrary...

CVE-2026-43499-S24U

Galaxy S24 UltraSM-S928U1용 CVE-2026-43499 펌웨어 S928U1UES6DZF2 를 실행하는 미국 Samsung Galaxy S24 Ultra를 위한 공개 소스 기반, 기기별 구현입니다. 지원 대상 Model: SM-S928U1 Codename: e3q Build / AP: S928U1UES6DZF2 / S928USQS6DZF2 Kernel: 6.1.145-android14-11-33419968-abS928USQS6DZF2 Architecture: arm64, 4K pages 대상 프로필은 펌웨어별...

CVE-2022-0847

CVE-2022-0847 Reference: Dirty Pipe vulnerability introduction PoC 1. Check kernel version uname -r 2. Compile and execute gcc poc.c...

CVE-2025-8045

CVE-2025-8045 — Arm Mali GPU KCPU キュー UAF CVE-2025-8045 は Arm Mali GPU カーネルドライバー（kbase）の use-after-free であり、このエクスプロイトはローカル権限昇格を実現します。非特権のローカルプロセスが CSF KCPU キュー のダンプパスと競合させて cpuqueue.buffer を解放・再取得し、解放済みアロケーションを自分が所有するページテーブル （"dirty pagetable"）に変え、そのプリミティブを使って任意のカーネル物理メモリ読み書きを獲得し、最終的に SELinux を...