WebKit-CVE-2016-4622

Análisis de WebKit CVE-2016-4622: Inmersión Profunda en la Vulnerabilidad del Slice ValueOf Fastpath Análisis completo y explotación de la vulnerabilidad del núcleo JavaScript de WebKit que permite la divulgación de memoria mediante la manipulación de Array.slice Tabla de Contenidos Resumen...

CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE

CVE-2026-3888 — snap-confine / systemd-tmpfiles Escalada de Privilegios Local Escalada de privilegios local desde un usuario sin privilegios hasta root completo en Ubuntu Desktop 24.04+ explotando una condición de carrera TOCTOU entre snap-confine y systemd-tmpfiles. Se proporcionan dos variantes...

CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2024-30088

CVE-2024-30088 Bug: El bug se encuentra dentro de la función AuthzBasepCopyoutInternalSecurityAttributes cuando el kernel copia la AUTHZBASEPSECURITYATTRIBUTESINFORMATION del objeto de token actual al modo usuario, cuya estructura es la siguiente: root@kitploit: //0x30 bytes sizeof struct...

CVE-2026-90009 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

EUVD-2026-80617

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

CVE-2026-90009

CVE-2026-90009 is a TOCTOU (time-of-check to time-of-use) race condition in the Linux kernel's scsi: bsg subsystem, specifically in scsi_bsg_uring_cmd() during io_uring passthrough command setup. The function reads bsg_uring_cmd fields from a shared mmap'd SQE; a local attacker with low privilege...

CVE-2026-90001 HID: bpf: serialize device reference release in struct_ops destroy path

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

EUVD-2026-80609

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-89917

A race condition in the Linux kernel's KVM arm64 hypervisor exists between the VNCR TLB invalidation path (which runs under the MMU lock) and vcpu_put() 's VNCR unmapping (which does not). The TOCTOU pattern on the TLB path checks vncr_tlb::cpu before unmapping, while this_cpu_reset_vncr_fixmap()...

EUVD-2026-80517

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle VNCR TLB invalidation race with vcpuput VNCR unmapping While VNCR TLB invalidation always occurs under the MMU lock, vcpuput doesn't, while it unmaps the VNCR page. The problem is that the invalidation evaluate...

CVE-2026-41651-analysis

CVE-2026-41651 — Análisis de Pack2TheRoot Escalada de privilegios local en PackageKit Condición de carrera TOCTOU CVSS v3.1: 8.8 ALTA | CWE-367 | Publicado: 2026-04-22 📌 Resumen Este repositorio recopila un informe de análisis personal y material de investigación sobre la vulnerabilidad de escala...

CVE-2025-3464-AsIO3-LPE

CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Exploit de escalación local sin privilegios para AsIO3.sys de ASUS - Bypass de autenticación TOCTOU + Decremento de PreviousMode CVE-2025-3464: Escalación de Privilegios Local en AsIO3.sys Este exploit solo funciona en Windows 11 22H2 o anterior. Microsoft...

pack2theroot-lab

Pack2TheRoot Lab — CVE-2026-41651 Un laboratorio de escalada de privilegios local estilo CTF, dockerizado y construido en torno al aviso Pack2TheRoot CVE-2026-41651, una vulnerabilidad de 12 años en el demonio PackageKit divulgada por el Red Team de Deutsche Telekom el 22 de abril de 2026. El...

SNEK_Equinox

SNEK Equinox Me gustaría agradecer a Nightmare-Eclipse por la inspiración no personal del proyecto UnDefend - https://web.archive.org/web/20260521145157/https://github.com/Nightmare-Eclipse/UnDefend: Ahora, curiosamente, encontré una manera de engañar a la consola web del EDR para mostrar que...

CVE-2026-41651

Pack2TheRoot — CVE-2026-41651 Carrera TOCTOU en el manejador de transacciones de PackageKit. Cualquier usuario local sin privilegios puede instalar paquetes arbitrarios como root sin autenticación. Resumen Campo| Valor ---|--- CVE| CVE-2026-41651 Componente| Demonio de PackageKit packagekitd...

CVE-2026-41651

🚨 CVE-2026-41651 — Pack2TheRoot Vulnerabilidad de escalada de privilegios en PackageKit condición de carrera TOCTOU 📌 Descripción general CVE-2026-41651 es una vulnerabilidad de escalada de privilegios local que afecta al servicio del sistema PackageKit utilizado en varias distribuciones de Linux...

rbndr

rbndr Simple DNS Rebinding Service rbndr is a very simple, non-conforming, name server for testing software against DNS rebinding vulnerabilities. The server responds to queries by randomly selecting one of the addresses specified in the hostname and returning it as the answer with a very low ttl...

rbndr

rbndr 简单的 DNS 重新绑定服务 rbndr 是一个非常简单的、非标准化的名称服务器，用于测试软件是否存在 DNS 重新绑定漏洞。该服务器通过从主机名中指定的地址中随机选取一个，并以极低的 TTL 值作为答案返回，来响应查询。 https://en.wikipedia.org/wiki/DNSrebinding DNS 重新绑定是一种 TOCTOU（检查时间与使用时间）漏洞。如果你有一个服务错误地使用“预检”检查来修改安全属性，那么你就可以使用它。例如，考虑一个（虚构的）浏览器插件，它有一个如下所示的 API： root@kitploit:...

CVE-2024-11222

GitLab CE/EE is affected by a Time-of-check Time-of-use (TOCTOU) race condition in pipeline creation, impacting versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . Under certain conditions, a developer user could perform actions in the context of another user's merge re...