Smap

nmap alternative powered by shodan.io Smap is a passive port scanner built with shodan.io's free API. It takes the same command line arguments as Nmap and produces the same output, which makes it a drop-in replacement for Nmap. Features Scans 200 hosts per second Doesn't require any account/api k...

CVE-2019-6225-macOS

CVE-2019-6225 Local Privilege Escalation for macOS ≤ 10.14.2 via CVE-2019-6225 Not yet tested on other machines, some hardcoded values might be incorrect. Does NOT work on machines with SMAP. It will crash your machine on the second run, no matter how the first run was. Most of the code are based...

nullmap

nullmap A very simple driver manual mapper based on my older voidmap and CVE-2023-21768 POC by chompie and b33f. Because the underlying IoRing post-exploitation memory r/w primitive is not handling many consequent reads and writes very well, I've decided to overwrite CR4 to disable SMEP/SMAP to...

macOS-Kernel-Exploit

macOS-Kernel-Exploit DISCLAIMER You need to know the KASLR slide to use the exploit. Also SMAP needs to be disabled which means that it's not exploitable on Macs after 2015. These limitations make the exploit pretty much unusable for in-the-wild exploitation but still helpful for security...

exploiting-cve-2017-5123

Exploiting CVE-2017-5123 Introduction This repository is an addition to the article published in MISC Magazine 96. We achieved to elevate our privileges in a reliable way, on our virtual machine with SMEP / SMAP and KASLR enabled. It should however be noted that the system if left in an unstable...

CVE-2022-25636-PipeVersion

CVE-2022-25636 파이프 버전 pipe-primitive를 사용하여 CVE-2022-25636을 익스플로잇하므로 kaslr 누출이나 smap, smep, ktpi 우회가 필요하지 않습니다 : Q: pipe-primitive가 무엇인가요? A: https://github.com/veritas501/pipe-primitive...

CVE-2021-22555-PipeVersion

CVE-2021-22555 파이프 버전 pipe-primitive를 사용하여 CVE-2021-22555를 익스플로잇하므로 kaslr 누출이나 smap smep ktpi 우회가 필요하지 않습니다 : 질문: pipe-primitive가 무엇인가요? 답변: https://github.com/veritas501/pipe-primitive Linux 4.15 및 Linux 5.8에서 테스트됨...

CVE-2022-0185-PipeVersion

CVE-2022-0185 pipe 버전 pipe-primitive를 사용하여 CVE-2022-0185를 익스플로잇하므로 kaslr leak이나 smap smep ktpi 바이패스가 필요하지 않습니다 : Q: pipe-primitive란 무엇인가? A: https://github.com/veritas501/pipe-primitive...

CVE-2017-5123

CVE-2017-5123 Exploit for the kernel vulnerability CVE-2017-5123 You can compile it with: gcc -static -Wall -Wextra -Werror -o cve20175123 CVE-2017-5123.c If you want further explanation, I've wrote an article explaining how it's work, you can find it here This exploit is more reliable than the...

CTT-NFS-Vortex-RCE

CTT-NFS-Vortex-RCE CVE-2026-21509 ⚠️ 기술 자문: 신물리학 공개 이 저장소는 Windows NFSNetwork File System, NFSv4.1 커널 모드 드라이버nfssvr.sys를 대상으로 하는 CVE-2026-21509 에 대한 완전한 무기화된 익스플로잇을 포함하고 있습니다. 정적 힙 오버플로우에 의존하는 일반적인 PoC와 달리, 이 익스플로잇은 수렴 시간 이론정리 4.2 을 활용하여 커널의 RPC 재조립 로직 내에서 난류 상전이 를 유도합니다. 📡 이론적 근거: 알파 공명 2026년 1월의...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: x86/entry: Clear X86FEATURESMAP when CONFIGX86SMAP=n Commit 3c73b81a9164 “x86/entry, selftests: Further improve user entry sanity checks” added a warning if AC is set when in the kernel. Commit 662a0221893a3d “x86/entry: Fix A...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15, and Linux 6.1

An integer overflow flaw was discovered in the Linux kernel. This issue causes the kernel to allocate skbsharedinfo in the user space, which can be exploited in systems without SMAP protection, as skbsharedinfo contains references to function pointers...

CVE-2026-52938

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

UBUNTU-CVE-2026-52938

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938 bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938 bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938

CVE-2026-52938 concerns a race in Linux kernel BPF storage: bpf_selem_unlink_nofail() clears smap before removal, allowing a concurrent reader in bpf_sk_storage_clone() to observe a NULL smap and dereference a NULL pointer, potentially crashing the kernel (DoS). Reports describe a null-ptr-deref ...

EUVD-2026-38708

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

PT-2026-51731

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the BPF Berkeley Packet Filter subsystem. The function bpf selem unlink nofail sets the smap variable to NULL before removing the element from the...