exploiting-cve-2017-5123

Exploitation de CVE-2017-5123 Introduction Ce dépôt est un complément à l'article publié dans MISC Magazine 96. Nous avons réussi à élever nos privilèges de manière fiable, sur notre machine virtuelle avec SMEP / SMAP et KASLR activés. Il convient toutefois de noter que le système est laissé dans...

CVE-2022-25636-PipeVersion

CVE-2022-25636 파이프 버전 pipe-primitive를 사용하여 CVE-2022-25636을 익스플로잇하므로 kaslr 누출이나 smap, smep, ktpi 우회가 필요하지 않습니다 : Q: pipe-primitive가 무엇인가요? A: https://github.com/veritas501/pipe-primitive...

Smap

بديل nmap مدعوم من shodan.io Smap هو ماسح منافذ سلبي مبني باستخدام واجهة shodan.io المجانية. يقبل نفس وسائط سطر الأوامر التي يقبلها Nmap وينتج نفس المخرجات، مما يجعله بديلًا مباشرًا لـ Nmap. الميزات يفحص 200 مضيف في الثانية لا يتطلب أي حساب/مفتاح API اكتشاف الثغرات يدعم صيغ مخرجات nmap بصمة الخدم...

CVE-2021-22555-PipeVersion

CVE-2021-22555 파이프 버전 pipe-primitive를 사용하여 CVE-2021-22555를 익스플로잇하므로 kaslr 누출이나 smap smep ktpi 우회가 필요하지 않습니다 : 질문: pipe-primitive가 무엇인가요? 답변: https://github.com/veritas501/pipe-primitive Linux 4.15 및 Linux 5.8에서 테스트됨...

nullmap

nullmap Un mapper de pilote manuel très simple basé sur mon ancien voidmap et le POC de CVE-2023-21768 par chompie et b33f. Étant donné que la primitive de lecture/écriture mémoire sous-jacente basée sur IoRing ne gère pas très bien les lectures et écritures consécutives, j'ai décidé d'écraser CR...

CVE-2022-0185-PipeVersion

CVE-2022-0185 version pipe Utilisation de pipe-primitive pour exploiter CVE-2022-0185, donc pas besoin de fuite de kaslr ni de contournement de smap smep ktpi : Q: Qu'est-ce que pipe-primitive? R: https://github.com/veritas501/pipe-primitive...

CVE-2017-5123

CVE-2017-5123 Эксплойт для уязвимости ядра CVE-2017-5123 Вы можете скомпилировать его с помощью: gcc -static -Wall -Wextra -Werror -o cve20175123 CVE-2017-5123.c Если хотите получить более подробное объяснение, я написал статью, объясняющую, как это работает, вы можете найти её здесь Этот эксплой...

CVE-2019-6225-macOS

CVE-2019-6225 Escalade de privilèges locale pour macOS ≤ 10.14.2 via CVE-2019-6225 Pas encore testé sur d'autres machines, certaines valeurs en dur pourraient être incorrectes. Ne fonctionne PAS sur les machines avec SMAP. Il fera planter votre machine au second lancement, peu importe comment s'e...

macOS-Kernel-Exploit

macOS-Kernel-Exploit ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ Чтобы использовать эксплойт, необходимо знать значение KASLR slide. Также необходимо отключить SMAP, что означает, что эксплойт неприменим на Mac после 2015 года. Эти ограничения делают эксплойт практически непригодным для эксплуатации «в дикой...

CVE-2026-52938

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

UBUNTU-CVE-2026-52938

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938 bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938

CVE-2026-52938 concerns a race in Linux kernel BPF storage: bpf_selem_unlink_nofail() clears smap before removal, allowing a concurrent reader in bpf_sk_storage_clone() to observe a NULL smap and dereference a NULL pointer, potentially crashing the kernel (DoS). Reports describe a null-ptr-deref ...

CVE-2026-52938

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

CVE-2026-52938 bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

EUVD-2026-38708

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpfskstorageclone and diag paths bpfselemunlinknofail sets SDATAselem-smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpfskstorageclone can observe th...

PT-2026-51731

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the BPF Berkeley Packet Filter subsystem. The function bpf selem unlink nofail sets the smap variable to NULL before removing the element from the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: x86/entry: Clear X86FEATURESMAP when CONFIGX86SMAP=n Commit: 3c73b81a9164 “x86/entry, selftests: Further improve user entry sanity checks” added a warning if AC is set when in the kernel. Commit: 662a0221893a3d “x86/entry: Fix...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15, and Linux 6.1

An integer overflow flaw was discovered in the Linux kernel. This issue causes the kernel to allocate skbsharedinfo in the user space, which can be exploited in systems without SMAP protection, as skbsharedinfo contains references to function pointers...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004085)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004085 advisory. In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NU...