triton-cve-2025-23320

Demonstrating CVE-2025-23320 This repo replicates CVE-2025-23320, demonstrating CWE-209, Generation of Error Message Containing Sensitive InformationCVSS Score: 7.5. This vulnerability exists on all NVIDIA Triton inference servers 25.06 and before. This docker setup runs a network containing an...

Triple_fetch

triplefetch - ianbeer https://bugs.chromium.org/p/project-zero/issues/detail?id=1247 This is an exploit for CVE-2017-7047, a logic error in libxpc which allowed malicious message senders to send xpcdata objects that were backed by shared memory. Consumers of xpc messages did not seem to expect th...

IPC-Memory-Mac-OSX-Exploit

IPC-Memory-Mac-OSX-Exploit IPC Local Security Bypass Inter Process Communication through shared memory is a concept where two or more process can access the common memory. And communication is done via this shared memory where changes made by one process can be viewed by another process. The kern...

CVE-2026-115912

A flaw was found in vLLM. In scale-out deployments utilizing shared-memory multimodal caching, worker nodes fail to validate shared-memory references provided in incoming requests. An authenticated remote attacker can exploit this vulnerability by submitting forged memory references pointing to...

CVE-2026-115912

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonicid values in public multimodal features.kwargsdata. In scale-out deployments with shared-memory multimodal caching enabled, workers trust...

CVE-2026-115912 vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonicid values in public multimodal features.kwargsdata. In scale-out deployments with shared-memory multimodal caching enabled, workers trust...

CVE-2026-115912

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonicid values in public multimodal features.kwargsdata. In scale-out deployments with shared-memory multimodal caching enabled, workers trust...

EUVD-2026-110022

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonicid values in public multimodal features.kwargsdata. In scale-out deployments with shared-memory multimodal caching enabled, workers trust...

CVE-2026-115912 vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonicid values in public multimodal features.kwargsdata. In scale-out deployments with shared-memory multimodal caching enabled, workers trust...

CVE-2026-115912

In versions prior to 0.32.0 , the vLLM inference and serving engine for large language models is vulnerable to arbitrary Python execution. An authenticated caller can exploit this by placing forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-o...

PT-2026-123435

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic id values in public multimodal features.kwargs data. In scale-out deployments with shared-memory multimodal caching enabled, workers tru...

CVE-2026-89987

A flaw was found in the Linux kernel's huge memory management. This vulnerability can lead to silent data loss for applications utilizing shared memory segments MAPSHARED tmpfs when Transparent Huge Pages THP and swap are active. The system fails to correctly mark modified memory as 'dirty,'...

CVE-2026-98802

A flaw was found in the Linux kernel. When processing IPv6 segment routing seg6 headers, the kernel modifies routing and destination address fields without first ensuring that the network packet buffer is writable. If the packet buffer is shared or cloned, such as during packet inspection or...

CVE-2026-90397

A flaw was found in the Linux kernel's Qualcomm qcom Secure Channel Manager SCM firmware component. This vulnerability allows for a NULL pointer dereference due to improper initialization of a shared memory pointer. An attacker could exploit this timing issue, potentially leading to a system cras...

...[ More ]

OpenBSD 7.9 contains kernel vulnerabilities involving a signed 16-bit System V shared memory attachment counter overflow, a use-after-free race condition, and an out-of-bounds write. These issues can be chained to allow a local attacker to escalate privileges to root, bypassing kernel protections...

SUSE CVE-2025-38241

In the Linux kernel, the following vulnerability has been resolved: mm/shmem, swap: fix softlockup with mTHP swapin Following softlockup can be easily reproduced on my test machine with: echo always /sys/kernel/mm/transparenthugepage/hugepages-64kB/enabled swapon /dev/zram0 zram0 is a 48G swap...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25, and 8.0.x below 8.0.12, when running PHP FPM SAPI with the main FPM daemon process running as the root user and child worker processes running as lower-privileged users, it is possible for the child processes to access memory...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free exists in the drivers/tee/teeshm.c file within the TEE subsystem of the Linux kernel, as of version 5.15.11. This issue arises due to a race condition during the teeshmgetfromid function, when attempting to free a shared memory object...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/shmem-helper: The erroneous “put” operation has been removed from the error path. The drmgemshmemmmap function does not have a reference in the error code path, resulting in the dma-buf shmem GEM object being freed...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix illegal rmbdesc access in SMC-D connection dump A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smcrun nginx smcrun wrk -t 16 -c 1000 -d -H 'Connection...