1468 matches found
cve-2023-21987-poc
cve-2023-21987-poc Vulnerabilidad de lectura fuera de los límites OOB-Read en VGA de Oracle VirtualBox Este Prueba de Concepto PoC está diseñado para un sistema operativo invitado Linux que se ejecuta en un sistema operativo anfitrión Windows. El propósito de este PoC es demostrar la capacidad de...
CVE-2024-5274
CVE-2024-5274 autores: @mistymntncop, @buptsb Reconocimiento a @buptsb por su gran contribución al descubrir tanto el POC de discrepancia de bytecode DCHECK como el descubrimiento de cómo elevar esa primitiva a primitivas más potentes de lectura/escritura fuera de límites OOB. Sin él, este exploi...
CVE-2026-98169
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...
CVE-2026-98372
The Linux kernel contains a stack out-of-bounds (OOB) read vulnerability in the xfrm: iptfs component. The issue stems from the iptfs_skb_reset_frag_walk() function, which uses an unbounded loop to advance fragments without checking if the index exceeds the nr_frags limit. While one caller is pro...
CVE-2026-98372
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...
EUVD-2026-93357
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...
EUVD-2026-93098
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...
CVE-2026-98169
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...
CVE-2026-98169 smb: client: fix potential OOB read in smb3_enum_snapshots()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...
CVE-2026-98169
A vulnerability exists in the Linux kernel 's SMB client where the smb3_enum_snapshots() function fails to verify the actual length of a server's reply. Specifically, if snapshot_array_size is smaller than GMT_TOKEN_SIZE, the function sets ret_data_len to the size of struct smb_snapshot_array. Si...
EUVD-2026-93097
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...
Linux Distros Unpatched Vulnerability : CVE-2026-98169
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct...
PT-2026-106701
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs skb reset frag walk iptfs skb reset frag walk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...
AlmaLinux 10 : kernel (ALSA-2026:71233)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:71233 advisory. kernel: block: zero non-PI portion of auto integrity buffer CVE-2026-23007 kernel: netfilter: ebtables SNAT target writes to shared memory pages during...
MiracleLinux 8 : kernel-4.18.0-553.167.1.el8_10 (AXSA:2026-1968:90)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1968:90 advisory. kernel: drm/amdgpu: Fix use-after-free race in VM acquire CVE-2026-43370 kernel: mac802154: llsec: add skbcowdata before in-place crypto...
nftables-oob-read-write-exploit-CVE-2023-35001-
Exploit de lectura/escritura fuera de límites OOB en nftables CVE-2023-35001 Exploit utilizado en pwn2own Vancouver 2023 en Ubuntu de escritorio. El exploit admite la versión del kernel disponible al comienzo del evento 5.19.0-35. Requisitos Compilador de C Compilador de Go Uso Build $ make Run $...
CVE-2022-1015
CVE-2022-1015 Un write-up y una prueba de concepto de escalada local de privilegios de una vulnerabilidad de lectura y escritura OOB en el kernel de Linux. Puedes encontrar el write-up de esta vulnerabilidad en mi blog y también puedes encontrar mi introducción a nftables aquí. Una nota important...
CVE-2021-30632
From: https://github.com/github/securitylab/tree/main/SecurityExploits/Chrome/v8/CVE-2021-30632 El análisis de este error se puede encontrar aquí. Este es un error de Chrome reportado por un investigador anónimo y se cree que fue explotado en la naturaleza. El exploit aquí presentado se probó en ...
weightBufs
WeightBufs: WeightBufs es un exploit de lectura/escritura del kernel para todos los dispositivos Apple con soporte de Neural Engine. Errores y exploit por @simo36; puedes leer mis diapositivas de la presentación en POC para más detalles sobre las vulnerabilidades y las técnicas de explotación. El...