kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...

kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

A flaw was found in the Linux kernel's ipvlan component. The ipvlan devices do not properly inherit neededheadroom and neededtailroom from the physical device phydev. This can lead to insufficient space being reserved for packet headers and trailers, potentially causing memory corruption, such as...

kernel: igc: set tx buffer type for SMD frames

A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

kernel: vsock/virtio: bind uarg before filling zerocopy skb

A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...

kernel: vsock/virtio: fix zerocopy completion for multi-skb sends

A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers skbs. An issue in how user arguments uargs are handled for these buffers can lead to pinned user pages not being...

Cooper-ndss-2022

Cooper: 協調的変異によるスクリプト言語のバインディングコードのテスト Cooperは、協調的変異を利用してスクリプト言語のバインディングコードをテストし、メモリ安全性の問題を発見します。協調的変異は、スクリプトコードと関連するドキュメントオブジェクトを同時に変更し、バインディングコードのさまざまなコードパスを探索します。協調的変異をサポートするために、スクリプトコードとドキュメントオブジェクトの関係を推論し、二次元の変異を導きます。私たちはツールCooperを、Adobe Acrobat、Foxit Reader、Microsoft...

CVE-2025-53020-PoC

CVE-2025-53020 - Apache httpd HTTP/2 メモリ枯渇 PoC CVE-2025-53020 の実証コードです。2025年半ばに発見した、Apache httpd の HTTP/2 実装におけるメモリ枯渇脆弱性です。 📖 詳細解説 : galbarnahum.com/posts/apache-httpd-cve-2025-53020 脆弱性の概要 Apache httpd は、HTTP/2 ヘッダー処理を介したサービス拒否攻撃に対して脆弱です。この脆弱性は、HTTP/2...

ICSFuzz

ICSFuzz: ICS制御アプリケーション用ファジングツール 概要 ICSFuzzは、ICS制御アプリケーションの脆弱性を発見するためのPLC側ファジングツールです。 著者: Dimitris Tychalas @ditihala .. @ditihala: https://www.twitter.com/ditihala インストール...

CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-

CVE-2025-24201 WebKit 脆弱性検出器 PoC この概念実証コードは、WebKit ベースのブラウザが CVE‑2025‑24201 に対して脆弱かどうかを検出します。これは、WebGL 実装における不適切な機能検証によって引き起こされる、深刻度の高いバッファ外書き込み（out-of-bounds write）の脆弱性 です。 🔍 脆弱性の概要 CVE‑2025‑24201 は、WebGLRenderingContext（WebGL 1）が定数 PRIMITIVERESTARTFIXEDINDEX（0x8D69）の有効化を許可したときに発生します。この機能は WebGL...

kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...

kernel: vsock/virtio: fix zerocopy completion for multi-skb sends

A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers skbs. An issue in how user arguments uargs are handled for these buffers can lead to pinned user pages not being...

kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

A flaw was found in the Linux kernel's ipvlan component. The ipvlan devices do not properly inherit neededheadroom and neededtailroom from the physical device phydev. This can lead to insufficient space being reserved for packet headers and trailers, potentially causing memory corruption, such as...

kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem, specifically within the SEV Secure Encrypted Virtualization feature. A malicious guest operating system utilizing SEV-SNP Secure Nested Paging can exploit an out-of-bounds write vulnerability due to improper...

kernel: vsock/virtio: bind uarg before filling zerocopy skb

A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...

kernel: igc: set tx buffer type for SMD frames

A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...

kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. When performing an asynchronous async copy operation, a programming error causes a stale identifier IDR entry to point to memory that has already been reused. This can lead to memory corruption, where the system...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

kernel: nfsd: fix UAF in async copy cancel and shutdown

A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...

GHSA-MJCV-P78Q-W5FW github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...