Lucene search
+L

153 matches found

Kitploit
Kitploit
added 2026/09/04 11:14 p.m.4 views

sandboxec

sandboxec 基于 Landlock 的轻量级 Linux 命令沙箱。 无需守护进程。无需 root。无需镜像构建步骤。 用它来运行有风险的命令,缩小爆炸半径:第三方 CLI、不受信任的脚本、生成的代码以及一次性工具。 目的 运行不受信任的代码通常是全有或全无的选择。 容器和虚拟机是很好的工具,但对于快速的命令级隔离来说可能过于繁重。容器增加了镜像和运行时开销。虚拟机提供了更强的隔离性,但设置和资源成本更高。 sandboxec 专注于更狭窄的任务:在当前主机上沙箱化一个命令,开销低,并具有显式的允许规则。 另见 : D. Siswanto, “The most practical...

5.9AI score
SaveExploits0References5
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.8 views

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “landlock”: Fixed the “dparent” walk. The WARNONONCE function in “collectdomainaccesses” can be triggered when trying to link a root mount point. This does not actually work in practice because this directory is already mounted,...

5.5CVSS5.9AI score0.00251EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.7 views

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fscrypt: destroy keyring after securitysbdelete The function fscryptDestroykeyring must be called after all potentially-encrypted inodes have been evicted; otherwise, it cannot safely destroy the keyring. Since inodes that are...

5.5CVSS6.2AI score0.00189EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.6 views

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Landlock: Do not lose track of restrictions on credtransfer. When a process’s credstruct is replaced, this mechanism almost always invokes the credprepare LSM hook. However, in one special case when KEYCTLSESSIONTOPARENT updates...

8.8CVSS6.2AI score0.00299EPSS
SaveExploits2References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.6 views

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: samples/landlock: Fixed the memory leak in pathlist. Clang static analysis reports this error. sandboxer.c:134:8: Warning: Potential memory leak pointed to by ‘pathlist’. ret = 0; ^ pathlist is allocated in parsepath, but never...

5.5CVSS6.2AI score0.00256EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/08/18 12:00 a.m.14 views

Linux Distros Unpatched Vulnerability : CVE-2026-72183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock...

8.4CVSS5.8AI score0.0017EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/08/17 4:03 p.m.13 views

CVE-2026-72183

A flaw was found in the Linux kernel's Landlock security module. A sandboxed process can bypass the intended signal isolation provided by LANDLOCKSCOPESIGNAL. By manipulating file descriptors with specific fcntl calls and asynchronous I/O SIGIO delivery, a local attacker can send signals, such as...

8.4CVSS5.5AI score0.0017EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/15 6:21 a.m.8 views

CVE-2026-72183

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

8.4CVSS0.0017EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:21 a.m.13 views

CVE-2026-72183

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

8.4CVSS5.7AI score0.0017EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/15 6:21 a.m.6 views

UBUNTU-CVE-2026-72183

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

8.4CVSS5.5AI score0.0017EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/08/15 5:53 a.m.28 views

CVE-2026-72183 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

8.4CVSS0.0017EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/15 5:53 a.m.26 views

CVE-2026-72183 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

8.4CVSS5.6AI score
SaveExploits0References7
CVE
CVE
added 2026/08/15 5:53 a.m.55 views

CVE-2026-72183

CVE-2026-72183 concerns a Linux kernel LANDLOCK bypass on the SIGIO path. The vulnerability allowed a sandboxed process that owns a file/socket to arm fcntl(F_SETOWN), F_SETSIG and O_ASYNC so that an I/O event would deliver a chosen signal to the entire process group, potentially affecting non-sa...

8.4CVSS5.5AI score0.0017EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/15 5:53 a.m.17 views

EUVD-2026-58941

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

5.5AI score0.0017EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/15 12:00 a.m.16 views

PT-2026-72371

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCK SCOPE SIGNAL bypass on the SIGIO path LANDLOCK SCOPE SIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery...

5.5AI score0.0017EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/23 11:41 a.m.10 views

PYSEC-2026-3504 PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

Summary praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports tha...

8.8CVSS6.5AI score
SaveExploits0References5
OSV
OSV
added 2026/07/20 9:46 p.m.12 views

CVE-2026-47128 nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

6.1CVSS5.4AI score
SaveExploits0References3
OSV
OSV
added 2026/06/26 8:33 p.m.11 views

GHSA-72W7-MF9G-733P nono-py has proxy-only network fallback bypass on older Linux kernels

Summary On Linux kernels that do not support Landlock network rules, nonopy.sandboxedexec could run CapabilitySet.proxyonlyproxy without supervising the seccomp-notify proxy-only fallback returned by the Rust core. In that configuration, a sandboxed child process could remove HTTPPROXY / HTTPSPRO...

6.4CVSS5.9AI score
SaveExploits0References3
OSV
OSV
added 2026/06/18 2:27 p.m.15 views

GHSA-6JCQ-6546-QRRW PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

Summary praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports tha...

8.8CVSS6.3AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/06/18 2:27 p.m.22 views

PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

Summary praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native path lets callers configure allowed filesystem paths and network=False. On systems where the optional sandlock module imports but reports tha...

10CVSS6.2AI score0.00383EPSS
SaveExploits1References2Affected Software1
Rows per page
Query Builder