CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 개념 증명 — WSL26.6.87.2-microsoft-standard-WSL2에서 ./sley 실행 후 uid=1000raken → uid=0root CVE-2026-43494 PinTheft에 대한 단일 파일 개념 증명PoC: RDS zerocopy 참조 횟수 버그 와 iouring 고정 버퍼 를 연쇄적으로 이용하여 SUID-root 바이너리의 페이지 캐시를 덮어쓰는 Linux 커널 로컬 권한 상승 취약점입니다. 면책 조항: 이 저장소는 공인된 보안 연구, 교육...

CVE-2026-23111-nftables-lab

CVE-2026-23111 nftables LPE: 노출 확인 및 안전한 실험실 CVE-2026-23111을 위한 방어 도구 및 재현 가능한 가상 머신 실험실입니다. 이는 리눅스 커널의 nftables use-after-free 로컬 권한 상승 nftmapcatchallactivate에서 요소 활성화 검사가 반전된 "off by !" 버그입니다. 권한이 없는 로컬 사용자가 권한 없는 사용자 네임스페이스를 통해 루트로 권한을 상승시키고 컨테이너를 탈출할 수 있습니다. 이 리포지토리는 익스플로잇을 포함하지 않습니다. 읽기 전용 노...

2006

2006 Linux 커널 익스플로잇 - CVE-2006-2451 + CVE-2006-3626...

CVE-2026-43284-DirtyFrag-PoC

CVE-2026-43284 — 4-byte XFRM/ESP Proof-of-concept local privilege escalation via XFRM/ESP page-cache corruption 4-byte write primitive · 48 iterations · 192-byte ELF overwrite · unprivileged user + netns Proof of concept Left: kernel preflight, setuid scan, and exploit chain · Right: root shell...

CVE-2026-31431

CVE-2026-31431 "Copy Fail" - 연구 및 침투 테스트 도구 ⚠️ 면책 조항 이 프로젝트는 다음 용도로만 엄격히 제공됩니다: 보안 연구 교육 목적 승인된 침투 테스트 CTF 및 실험실 환경 이 도구를 사용함으로써 귀하는 다음에 동의합니다: 귀하가 대상 시스템의 소유자이거나 대상 시스템을 테스트할 명시적인 서면 승인을 받았습니다. 이 프로젝트를 불법 또는 악의적인 활동에 사용하지 않을 것입니다. 허가되지 않은 접근에 따른 모든 법적 및 윤리적 결과를 이해합니다. 저자와 기여자는 이 소프트웨어를 사용하여 발생한...

gemini-2.5-pro-nf-tables-red-teamin

gemini-2.5-pro-nf-tables-red-teamin A technical case study and timeline dataset documenting Google Gemini 2.5 Pro's safety alignment policies, guardrails, and refusal behavior evolution regarding legacy Linux kernel vulnerability primitives CVE-2023-32233. Link to case study website :...

CVE-2022-27666

CVE-2022-27666 Heap buffer overflow in Linux kernel's IPsec ESP6 implementation linux 5.13.19. Setup Assuming root user 1. Build Kernel inside VM Install dependencies: root@kitploit: apt update && apt install -y \ build-essential bc bison flex \ libssl-dev libelf-dev libncurses-dev \ dwarves...

kernel-exploit-dirtycow

커널 익스플로잇 — Dirty Cow CVE-2016-5195 Dirty Cow 취약점을 이용한 권한 상승 실습으로, 4Geeks Academy 사이버보안 전문 과정의 일부로 수행되었습니다. 설명 Dirty Cow는 Linux 커널의 메모리 하위 시스템에 존재하는 경쟁 조건race condition 취약점CVE-2016-5195으로, 권한이 없는 로컬 사용자가 /etc/passwd를 포함한 읽기 전용 메모리 영역에 쓰기 액세스 권한을 얻을 수 있게 합니다. 이를 통해 관리자 자격 증명 없이 root로 직접 권한을 상승시킬 수...

dirty_frag_mitigation

dirtyfragmitigation 1. A bash script for mitigating linux dirty frag exploit CVE-2026-43500 2. Works on all Debian/Ubuntu Arch based platforms i.e. Kali, ParrotSec, BlackArch 3. Added --check to run as non-root user. Added fragnesia support as it shares the same patch surface with dirtyfrag...

CyberMeowfia-ace3

웹사이트: nebusec.ai · 트위터 @nebusecurity · 버그 목록 885개 이상 IonStack 후속 조치, https://github.com/NebuSec/CyberMeowfia/issues/44 참조 최신 연구 IonStack part II : GhostLock, 15년 동안 모든 Linux 배포판에 존재해온 스택 UAF Linux Kernel 📖 글 · 🐦 트위터 Longinus : 한 버그에 담긴 두 개의 경계, 단일 취약점으로 Chrome의 Renderer와 V8 샌드박스 뚫기, CVE-2026-6307...

rootpacket-cve-2026-31431

rootpacket CVE-2026-31431 A Linux Docker-to-host cryptojacking toolkit captured from live attacks on Kinryū Labs honeypots. It breaks in through an exposed Docker Engine API, escapes the container to root the host with CVE-2026-31431 , installs a kernel rootkit, and runs an XMRig Monero miner. Fu...

CVE-2022-0847-Docker

Dirty Pipe CVE-2022-0847: A Hands-On Exploit Demonstration in Docker This repository provides a self-contained, interactive Docker environment to safely demonstrate and analyze the "Dirty Pipe" privilege escalation vulnerability. It is designed as an educational tool for security professionals to...

2009

2009 Linux 커널 익스플로잇 - CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547...

kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()

A flaw was found in the Linux kernel's iouring/poll component. A logic error exists in the iopollgetownership function due to an incorrect signed comparison. This flaw prevents the necessary slowpath from being triggered when the IOPOLLCANCELFLAG is set, potentially leading to unexpected behavior...

kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()

A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...

kernel: smb: client: fix query directory replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the client attempts to free the same memory buffer twice during a directory query operation. An attacker could potentially exploit this flaw to cause memory corruption,...

K000163315: Linux kernel vulnerabilities CVE-2026-63884, CVE-2026-64219, CVE-2026-64496

Security Advisory Description CVE-2026-63884 In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to actually get the right...

CVE-2015-8660

CVE 2015-8660 Research Description This is research I conducted on the CVE 2015-8660 overlayFS vulnerability for my Operating System Security course final research project. The goal of this project was to find a Linux kernel vulnerability from 2012-2022, explain the vulnerability, explain the...

CVE-2026-31431

CVE-2026-31431 — Copy Fail tracking site Source for the Copy Fail patch-status tracker: a single-page site recording which distributions have shipped a fix for the algifaead privilege escalation in the Linux kernel. Where the facts live Everything about the bug — CVE IDs, affected and fixed...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset CVE-2025-68745 kernel: drm/xe: Open-code GGTT MMIO access protection CVE-2026-2346...