exploiting-cve-2017-5123

Эксплуатация CVE-2017-5123 Введение Этот репозиторий является дополнением к статье, опубликованной в журнале MISC №96. Нам удалось надёжно повысить свои привилегии на нашей виртуальной машине с включёнными SMEP / SMAP и KASLR. Однако следует отметить, что система остаётся в нестабильном состоянии...

CVE-2022-25636-PipeVersion

CVE-2022-25636 파이프 버전 pipe-primitive를 사용하여 CVE-2022-25636을 익스플로잇하므로 kaslr 누출이나 smap, smep, ktpi 우회가 필요하지 않습니다 : Q: pipe-primitive가 무엇인가요? A: https://github.com/veritas501/pipe-primitive...

Smap

shodan.io 기반 nmap 대안 Smap은 shodan.io의 무료 API로 구축된 패시브 포트 스캐너입니다. Nmap과 동일한 명령줄 인수를 받아들이고 동일한 출력을 생성하므로 Nmap을 그대로 대체할 수 있는 도구입니다. 기능 초당 200개 호스트 스캔 계정/API 키 불필요 취약점 탐지 nmap 출력 형식 지원 서비스 및 버전 핑거프린팅 패시브 모드에서 대상과 접촉하지 않음 Shodan이 보고한 포트를 사용한 선택적 nmap 가속 설치 바이너리 사전 빌드된 바이너리를 여기에서 다운로드하여 바로 사용할 수 있습니다. ...

CVE-2021-22555-PipeVersion

CVE-2021-22555 파이프 버전 pipe-primitive를 사용하여 CVE-2021-22555를 익스플로잇하므로 kaslr 누출이나 smap smep ktpi 우회가 필요하지 않습니다 : 질문: pipe-primitive가 무엇인가요? 답변: https://github.com/veritas501/pipe-primitive Linux 4.15 및 Linux 5.8에서 테스트됨...

CVE-2022-0185-PipeVersion

CVE-2022-0185 pipe 버전 pipe-primitive를 사용하여 CVE-2022-0185를 익스플로잇하므로 kaslr leak이나 smap smep ktpi 바이패스가 필요하지 않습니다 : Q: pipe-primitive란 무엇인가? A: https://github.com/veritas501/pipe-primitive...

CVE-2017-5123

CVE-2017-5123 Эксплойт для уязвимости ядра CVE-2017-5123 Вы можете скомпилировать его с помощью: gcc -static -Wall -Wextra -Werror -o cve20175123 CVE-2017-5123.c Если хотите получить более подробное объяснение, я написал статью, объясняющую, как это работает, вы можете найти её здесь Этот эксплой...

CVE-2019-6225-macOS

CVE-2019-6225 Escalade de privilèges locale pour macOS ≤ 10.14.2 via CVE-2019-6225 Pas encore testé sur d'autres machines, certaines valeurs en dur pourraient être incorrectes. Ne fonctionne PAS sur les machines avec SMAP. Il fera planter votre machine au second lancement, peu importe comment s'e...

macOS-Kernel-Exploit

macOS-Kernel-Exploit ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ Чтобы использовать эксплойт, необходимо знать значение KASLR slide. Также необходимо отключить SMAP, что означает, что эксплойт неприменим на Mac после 2015 года. Эти ограничения делают эксплойт практически непригодным для эксплуатации «в дикой...

CVE-2026-52938

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

UBUNTU-CVE-2026-52938

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938 bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938

CVE-2026-52938 concerns a race in Linux kernel BPF storage: bpf_selem_unlink_nofail() clears smap before removal, allowing a concurrent reader in bpf_sk_storage_clone() to observe a NULL smap and dereference a NULL pointer, potentially crashing the kernel (DoS). Reports describe a null-ptr-deref ...

CVE-2026-52938 bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

EUVD-2026-38708

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

PT-2026-51731

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the BPF Berkeley Packet Filter subsystem. The function bpf selem unlink nofail sets the smap variable to NULL before removing the element from the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: x86/entry: Clear X86FEATURESMAP when CONFIGX86SMAP=n Commit: 3c73b81a9164 “x86/entry, selftests: Further improve user entry sanity checks” added a warning if AC is set when in the kernel. Commit: 662a0221893a3d “x86/entry: Fix...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15, and Linux 6.1

An integer overflow flaw was discovered in the Linux kernel. This issue causes the kernel to allocate skbsharedinfo in the user space, which can be exploited in systems without SMAP protection, as skbsharedinfo contains references to function pointers...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004085)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004085 advisory. In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NU...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004431)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004431 advisory. In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NU...