CVE-2021-33624

Proof of Concept for CVE-2021-33624 compile with gcc -pthread -o bpfspectretypeconfusion bpfspectretypeconfusion.c -Wall -ggdb -std=gnu99 execute with sudo ./bpfspectretypeconfusion 1 2 ffffffffa4925620 0x10 where 1 and 2 are CPU threads which run on two distinct hardware cores, ffffffffa4925620 ...

CVE-2022-0847-DirtyPipe-Container-Breakout

DirtyPipe Container Breakout PoC This repo contains a PoC for the dirtypipe kernel vulnerability, for breaking out of a container. Further explanation can be found in this blog post...

kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

A flaw was found in the Linux kernel's SCSI target subsystem. This vulnerability, a buffer overflow, occurs in the tgptgpmembersshow function when processing long iSCSI IQN names. An attacker could potentially exploit this by providing a specially crafted input, leading to the disclosure of...

kernel: ipv6: exthdrs: refresh nh after handling HAO option

A flaw was found in the Linux kernel's IPv6 extension header processing. When processing the Home Address Option HAO, the cached network header pointer may become invalid if the packet's memory is reallocated. This can lead to incorrect parsing of subsequent IPv6 Type-Length-Value TLV options,...

kernel: ipv6: validate extension header length before copying to cmsg

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...

kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

A flaw was found in the Linux kernel's nfnetlinkcthelper component. This vulnerability, an out-of-bounds read, occurs in the nfnlcthelperdumptable function when a network connection tracking helper is removed during a dump operation, leading to a bypassed bounds check. A local attacker could...

hbp-attack-demo

fork from https://github.com/veritas501/hbpattackdemo hbpattack demo Reference: P0 blog: https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html Created a vuln module, pretending we have a kernel arbitrary address write primitive, but KASLR is...

af_packet.c

afpacket.c Proof-Of-Concept to check privileges of afpacket.c for validating the privileges acquired by any hacker upon successful exploitation of CVE-2021-22600 It is just a sample proof of concept generated by LLM and does not cover all cases. The basic idea behind this proof of concept is to...

CVE-2022-0185-Case-Study

CVE-2022-0185-Case-Study This case study is a result of an assignment of ECE 9069: Introduction to Hacking : https://whisperlab.org/introduction-to-hacking/ CVE-2022-0185 Overview CVE-2022-0185 is a heap-based buffer overflow flaw was found in the way the legacyparseparam function in the Filesyst...

CVE-2022-0847-dirty-pipe-exploit

CVE-2022-0847-dirty-pipe-exploit An exploit for CVE-2022-0847 dirty-pipe vulnerability How to use this Compile with gcc exploit.c -o exploit assumes gcc is installed Run ./exploit and it'll pop a root shell If you are getting error message like then, Login as root with password cspshivam Then,...

container-cve-2021-22555

Reproducer for CVE-2021-22555 as a container First, this rolls in the exploit code from here as a handy pre-built container: https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 Pre-built container: quay.io/cgwalters/cve-2021-22555 Mitigation: seccomp profiles A stron...

Codeine

Codeine .o88b. .d88b. d8888b. d88888b d888888b d8b db d88888b d8P Y8 .8P Y8. 88 8D 88' 88' 888o 88 88' 8P 88 88 88 88 88ooooo 88 88V8o 88 88ooooo 8b 88 88 88 88 88 88 88 V8o88 88 Y8b d8 8b d8' 88 .8D 88. .88. 88 V888 88. Y88P' Y88P' Y8888D' Y88888P Y888888P VP V8P Y88888P Codeine is a Linux LKM...

CVE-2022-0847-eBPF

CVE-2022-0847-eBPF An eBPF program to detect and defense attacks on CVE-2022-0847. In the kernel space, the program detects splice system calls, if such a system call contains a pipe as the output fd, and the flags of the pipe buffer is set to PIPEBUFFLAGCANMERGE , then an event would be submitte...

CVE-2023-2598

CVE-2023-2598 what's iouring? ​ iouring is a system call interface for Linux. It has supported almost all system call so far, not only read and write initially. It enables an application to initiate system calls that can be performed asynchronously. Submission and Completion Queues At the core of...

CVE-2016-6187_LPE

CVE-2016-6187 - Linux Kernel Exploit Kernel Exploit for CVE-2016-6187 Local Privilege Escalation affected versions: 4.6.5 Exploit was developed against a custom compiled 4.6 kernel + buildroot kconfig coming soon and defeats KASLR, SMEP, SMAP KPTI not available for 4.6 Presentation slides...

cve-2025-39682

CVE-2025-39682 exploit on kernelCTF mitigation instance This is also my first ? idk, this is a variant of CVE-2024-58239 1-day exploit. Patch: tls: fix handling of zero-length records on the rxlist This CVE was used in exp398 and and exp403. kernelCTF spreadsheet. For folder structures and how to...

CVE-2014-9322

CVE-2014-9322 PoC for Linux kernel CVE-2014-9322 a.k.a BadIRET proof of concept for Linux kernel. This PoC uses only syscalls not any libraries, like pthread. Threads are implemented using raw Linux syscalls. Raw Linux Threads via System Calls Usage $ make badiret.elf is an ELF executable...

NFSundown

Overview Proof-of-Concept exploit for NFSundown CVE-2025-38089. It can remotely trigger a kernel crash in an NFS server. Details A remote attacker can trigger a kernel null pointer dereference and crash the kernel by sending a specially crafted RPC request. This occurs due to improper handling of...

exploiting-cve-2017-5123

Exploiting CVE-2017-5123 Introduction This repository is an addition to the article published in MISC Magazine 96. We achieved to elevate our privileges in a reliable way, on our virtual machine with SMEP / SMAP and KASLR enabled. It should however be noted that the system if left in an unstable...

CVE-2019-13272

CVE-2019-13272 Linux local root exploit Linux 4.10 5.1.17 PTRACETRACEME local root CVE-2019-13272 In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtai...