RDS_CVE-2019-0708

RDSCVE-2019-0708...

pintheft

PinTheft — RDS zerocopy double-free LPE tracking site Source for the PinTheft patch-status tracker: a single-page site recording which distributions have shipped a fix for the RDS zerocopy double-free privilege escalation in the Linux kernel. Where the facts live Everything about the bug — CVE ID...

CVE-2026-43494-PinTheft-PoC

SLEY — PoC de PinTheft CVE-2026-43494 Prueba de concepto — uid=1000raken → uid=0root después de ./sley en WSL2 6.6.87.2-microsoft-standard-WSL2 Prueba de concepto de un solo archivo para CVE-2026-43494 PinTheft: una escalada local de privilegios en el kernel de Linux que encadena un bug de conteo...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

CVE-2019-0708

CVE-2019-0708 BlueKeep 预认证 RCE POC 在 Windows7 上 本仓库演示了 Windows 远程桌面服务 RDS 中的远程代码执行漏洞。 这是我们之前开发的关于 BlueKeep 漏洞的 POC 代码和技术报告。 注意： 我们的目标是帮助分析人员更好地理解关键漏洞。 使用方法 前置条件 我们的利用代码使用 Python 3 编写，并依赖于 PyRDP 库。请按照 PyRDP 的安装指南进行设置。 用法 目前，我们的利用工具针对并在 Virtual Box 上的 Windows 7 SP 1 6.1.7601 x64 上进行了测试。 如果你的计算机 IP...

aws_public_ips

awspublicips...

CVE-2026-21533_Scanner.py

CVE-2026-21533 Scanner: Windows RDP Local Privilege Escalation Detection Tool Este repositorio contiene una herramienta de detección para la vulnerabilidad CVE-2026-21533, una falla de gestión de privilegios en los Servicios de Escritorio Remoto RDS de Windows que podría permitir a un atacante...

PinTheft-go

pintheft-go Go 移植版 pintheft - RDS zcopy 双重释放本地权限提升。属于 Dirty Frag 漏洞类别。 !IMPORTANT Arch Linux 是该漏洞最容易暴露的发行版之一，因为它是少数几个默认情况下通常可以加载 RDS 模块的发行版之一。 工作原理（长话短说） 该漏洞位于 rdsmessagezcopyfromuser 函数中。该函数通过 FOLLGET 逐个 GUP-钉住用户页面。如果后续页面发生页错误（例如 PROTNONE 保护页），错误路径会对已钉住的页面调用 putpage，然后 rdsmessagepurge 再次对这些页面调用...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 概念验证 — uid=1000raken → uid=0root 在 WSL2 6.6.87.2-microsoft-standard-WSL2 上执行 ./sley 后 针对 CVE-2026-43494 （ PinTheft ）的单文件概念验证：一种 Linux 内核本地权限提升漏洞，它利用 RDS 零拷贝引用计数错误 与 iouring 固定缓冲区 链式攻击，覆写 SUID-root 二进制文件的页面缓存。 免责声明： 本仓库仅限 授权的安全研究、教育和防御性测试...

CVE-2026-48282-coldfusion-rds-detection

CVE-2026-48282 — Adobe ColdFusion RDS 验证与检测 针对 Adobe ColdFusion 远程开发服务（RDS）中 CVE-2026-48282 的实验室验证，重点关注技术证据、事件重建和防御性检测机会。 本仓库记录了一次受控测试，其中利用存在漏洞的 RDS FILEIO 功能向 ColdFusion 应用程序目录写入了一个 CFM 文件。通过 HTTP 调用该文件后，ColdFusion 启动了系统 Shell 并建立了出站连接。由此产生的进程和网络活动已通过 Linux auditd、tcpdump、Docker 遥测、ColdFusion 日志...

CVE-2026-43494

🛠️ PinTheft — CVE-2026-43494 Local Privilege Escalation in Linux Kernel via RDS + iouring Page Cache Overwrite 📌 Overview PinTheft is a sophisticated local root exploit for CVE-2026-43494 , a reference-counting bug in the Linux kernel's Reliable Datagram Sockets RDS subsystem. By combining a...

CVE-2026-43494-PinTheft-PoC

SLEY — PoC de PinTheft CVE-2026-43494 Prueba de concepto — uid=1000raken → uid=0root después de ./sley en WSL2 6.6.87.2-microsoft-standard-WSL2 Prueba de concepto en un solo archivo para CVE-2026-43494 PinTheft: una escalada de privilegios local del kernel de Linux que encadena un error de conteo...

The vulnerability of the rds_ib_setup_qp() function in the net/rds/ib_cm.c module of the Linux kernel’s networking functions allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rdsibsetupqp function in the net/rds/ibcm.c module of the Linux kernel’s networking functions is related to unlimited distribution of resources. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the rds_ib_send_unmap_op() function in the net/rds/ib_send.c module, which is part of the networking functions of the Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the rdsibsendunmapop function in the net/rds/ibsend.c module, which is part of the networking functions in the Linux kernel, relates to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

VulnCheck KEV: CVE-2026-43494

In the Linux kernel, the following vulnerability has been resolved: net/rds: reset opnents when zerocopy page pin fails When iovitergetpages2 fails in rdsmessagezcopyfromuser, the pinned pages are released with putpage, and rm-data.opmmpznotifier is cleared. But we fail to properly clear...

The vulnerability of the rds_ib_get_mr() function in the net/rds/ib_rdma.c module, which is part of the Linux kernel’s networking functions, allows a hacker to cause a service failure.

The vulnerability of the rdsibgetmr function in the net/rds/ibrdma.c module, which implements kernel networking functions in the Linux operating system, is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the rds_tcp_tune() function in the net/rds/tcp.c module, which implements networking functions for the Linux operating system’s kernel, allows a hacker to cause a service failure.

The vulnerability of the rdstcptune function in the net/rds/tcp.c module, which implements networking functions in the Linux kernel, is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause service failures...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fixed an issue where a use-after-free occurred in net in reqsktimerhandler. syzkaller reported a warning regarding the netns tracker 0, followed by KASAN, SPLAT 1, and another ref tracker warning 1. syzkaller was unable...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/rds: The reconnect-pending bit. When canceling the reconnect worker, care must be taken to reset the reconnect-pending bit. If the reconnect worker has not yet been scheduled before it is canceled, the reconnect-pending bit...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A flaw was discovered in the Linux Kernel’s RDS Reliable Datagram Sockets protocol. The rdsrmzerocopycallback function uses listentry on the head of a list, resulting in a type confusion. A local user can trigger this with the rdsmessageput function. This type confusion causes the struct...