cve-2022-0185-crash-poc

Contêiner executando POC de crash do cve-2022-0185 Este é um contêiner docker que executa o POC de crash de https://www.willsroot.io/2022/01/cve-2022-0185.html. O contêiner executa sem privilégios como UID 65534. Você também pode usar docker run -u ou definir, adicionalmente, um contexto de...

container-cve-2021-22555

CVE-2021-22555 के लिए रिप्रोड्यूसर एक कंटेनर के रूप में सबसे पहले, यह एक्सप्लॉइट कोड को यहाँ से एक सुविधाजनक पहले से निर्मित कंटेनर के रूप में शामिल करता है: https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 पहले से निर्मित कंटेनर: quay.io/cgwalters/cve-2021-22555...

harden-docker-seccomp

harden-docker-seccomp Idempotentes Skript, um die Erstellung von AFALG-Sockets für alle Docker-Container auf einem Host zu blockieren, als Abschwächung für CVE-2026-31431 „Copy Fail". Hintergrund CVE-2026-31431 ist eine lokale Privilegieneskalation in der kryptografischen authencesn-Vorlage des...

cve-2026-31431-mitigation

CVE-2026-31431 seccomp-Mitigation Eine leichtgewichtige, reversible seccomp-basierte Mitigation für CVE-2026-31431, eine lokale Privilegieneskalations-Schwachstelle im algifaead-/authencesn-Krypto-Subsystem des Linux-Kernels. 中文文档 Überblick über die Schwachstelle Typ: Lokale Privilegieneskalation...

Hulios

Hulios Sistema Onion e Invisibilità Linux Universale Indurito Hulios è un gateway VPN Tor trasparente per Linux basato su eBPF. Protegge il traffico di rete in uscita reindirizzando i socket TCP e le query DNS attraverso un'istanza integrata di Arti client Tor e un resolver DNS localizzato basato...

Z-Jail

Z-Jail Sandbox multistrato per l'esecuzione di codice nativo su Linux. Sette livelli di difesa indipendenti — nessuna dipendenza esterna, binario PIE di circa 73 KiB. root@kitploit: ┌──────────────────────────────────────────────────────┐ │ Z-Jail │...

kafel

COS'È? Kafel è un linguaggio e una libreria per specificare politiche di filtraggio delle syscall. Le politiche vengono compilate in codice BPF che può essere utilizzato con seccomp-filter. Questo NON è un prodotto ufficiale di Google. Utilizzo Con segnalazione dettagliata degli errori...

sniffglue

sniffglue sniffglue is a network sniffer written in rust. Network packets are parsed concurrently using a thread pool to utilize all cpu cores. Project goals are that you can run sniffglue securely on untrusted networks and that it must not crash when processing packets. The output should be as...

docker_escape_pwn

Escape da Docker usando CVE-2017-1000112 e CVE-2017-18344. Includendo: ottenere privilegio di root ottenere tutte le capabilities ripristino del namespace ripristino del filesystem bypass delle limitazioni cgroup bypass di seccomp...

firejail

Firejail Firejail è uno strumento di sicurezza leggero pensato per proteggere un sistema Linux creando un ambiente ristretto per eseguire applicazioni potenzialmente non affidabili. Più precisamente, è un programma sandbox SUID che riduce il rischio di violazioni della sicurezza utilizzando i...

GHSA-7236-3392-C5C6 BuildKit: Custom frontend could bypass Seccomp/AppArmor

Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...

BuildKit: Custom frontend could bypass Seccomp/AppArmor

Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...

CVE-2026-61711

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-61711

In BuildKit versions prior to 0.31.1, the file executor/oci/spec_linux.go treated an invalid SecurityMode value from a crafted build request as non-sandbox mode without requiring the security.insecure entitlement, disabling Seccomp and AppArmor protections for the build container. Linux capabilit...

CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

EUVD-2026-62838

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/speclinux.go treated the unsupported value as a...

PT-2026-78679

Name of the Vulnerable Software and Affected Versions BuildKit versions prior to 0.31.1 Description BuildKit is a toolkit used to convert source code into build artifacts. A custom frontend can send a crafted build request containing an invalid SecurityMode value. The executor/oci/spec linux.go...

CVE-2026-68171

A flaw was found in the Linux kernel's arm64 syscall handling. A local attacker with the ability to trace processes using ptrace could manipulate syscall arguments after security checks like seccomp, or secure computing mode have been performed. This occurs because the kernel's internal record of...