sfop

基于段错误导向编程（Segmentation Fault-Oriented Programming，SFOP） 这是段错误导向编程（Segmentation Fault-Oriented Programming）利用技术的工件（artifacts）仓库。 工件集 这里我们简要描述本仓库中的工件。总共有八个不同的工件，包含六个 PoC 漏洞利用程序和两个针对真实世界程序（Nginx 和 Ladybird）的漏洞利用程序： PoC： bSFOPek：完整的 bSFOP 漏洞利用程序，使用一个链（chain）来注册信号，并通过 Early Kill 发起攻击。 bSFOPfixed：更易于调试...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5647: Initialize subdev before controls In the function ov5647initcontrols, we call v4l2getsubdevdata, but this initialization is actually done by v4l2i2csubdevinit within the probe function. Currently, this happens...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.11 contains a segmentation violation through the function decodercontext::processSliceSegmentHeader in decctx.cc...

Astra Linux – Vulnerability in Nasm

In Netwide Assembler NASM 2.15rc10, the SEGV condition can be triggered in toktext within asm/preproc.c by accessing the READ memory...

Astra Linux – Vulnerability in Raptor2

A malformed input file can lead to a segfault due to an out of bounds array access in raptorxmlwriterstartelementcommon...

CVE-2022-34913

CVE-2022-34913 描述 md2roff 1.7 存在基于栈的缓冲区溢出漏洞，可通过包含大量连续待处理字符的 Markdown 文件触发。 复现 要复现该漏洞，我们需要下载存在漏洞的 md2roff 版本（1.7 版）： root@kitploit: git clone https://github.com/nereusx/md2roff.git cd md2roff git checkout 7fc373d25c91422454f081c8a717222d77fd7add make 项目编译完成后，我们可以先创建一个包含大量 ASCII 字符缓冲区的恶意 markdown 文...

CVE-2022-34556

CVE-2022-34556 の説明 PicoC v3.2.2 には、variable.c に NULL ポインタ参照の脆弱性があることが判明しました。Picoc を使用するプロジェクトやライブラリも、この問題の影響を受けます。例としては、picoc-js が挙げられます。 環境のセットアップ PicoC の NULL ポインタ参照の脆弱性を再現するには、まず PicoC ライブラリとインタプリタの脆弱性のあるバージョン v3.2.2 をダウンロードしてコンパイルする必要があります: root@kitploit: git clone...

bigdecimal-segfault-fix

h1. BigDecimal Segfault Fix BigDecimalライブラリにセグフォルトバグがあり、既知の不正な値をユーザーが提供することでトリガーされる可能性があります。アプリケーションが安全かどうかをテストするには、+example.rb+ を実行してください。このスクリプトは正常に終了し、セグフォルトを起こさないはずです。 この回避策には副作用があります。具体的には、BigDecimal を使用して大きな数値（255桁以上）を扱うことや、科学的記数法（例：5000000に対して...

FreeBSD : expat2 -- Out-of-bounds Read (11ab3b16-a65d-11f1-a49c-00a0980083d7)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 11ab3b16-a65d-11f1-a49c-00a0980083d7 advisory. https://github.com/libexpat/libexpat/pull/1331 reports: Expat through 2.8.3 contains an out-of-bounds...

kernel: seccomp: passthrough uretprobe systemcall without filtering

A flaw was found in the Linux kernel. This vulnerability occurs when uretprobes, a debugging feature that monitors function returns in user-space programs, are used. The kernel's seccomp secure computing mode mechanism, which restricts system calls a program can make, incorrectly blocks the...

SUSE CVE-2026-80705

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

CVE-2026-80705

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

UBUNTU-CVE-2026-80705

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

CVE-2026-80705

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

CVE-2026-80705

CVE-2026-80705 affects the Linux kernel in the drm/amd/display subsystem. The function dml21_add_phantom_plane() could fail to allocate a phantom plane, and the failure was not checked before subsequent use, leading to a later segfault (null pointer dereference). The fix verifies that the phantom...

EUVD-2026-67440

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

CVE-2026-80705 drm/amd/display: check if dml21_add_phantom_plane() is successful

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

Linux Distros Unpatched Vulnerability : CVE-2026-80705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit...

Astra Linux – Vulnerability in binutils

A issue was discovered in the Binary File Descriptor BFD library also known as libbfd, as distributed in GNU Binutils 2.32. It is an out-of-bounds read that leads to a segmentation fault in bfdgetl32 in libbfd.c, when called from pex64getruntimefunction in pei-x8664.c...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed memory leakage This patch addresses potential memory leakage and segmentation faults in the gpuvmimportdmabuf function...