Input validation

In binderthreadread of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndro...

Qualcomm Android - Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL

Qualcomm Android - Kernel Use-After-Free via Incorrect setpagedirty in KGSL The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm and possibly others: When kgslmementrydestroy in drivers/gpu/msm/kgsl.c is called for a writable entry with...

Qualcomm Android - Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL Exploit

The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm and possibly others: When kgslmementrydestroy in drivers/gpu/msm/kgsl.c is called for a writable entry with memtype KGSLMEMENTRYUSER, it attempts to mark the entry's pages as dirty...

Qualcomm Android - Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL

The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm and possibly others: When kgslmementrydestroy in drivers/gpu/msm/kgsl.c is called for a writable entry with memtype KGSLMEMENTRYUSER, it attempts to mark the entry's pages as dirty...

Use-After-Free (UAF)

Firefox Firefox ESR and Thunderbird are vulnerable to use-after-free vulnerability. A memory error may occur when an IndexedDB index is deleted while still in use allowing remote unauthenticated attackers to crash the application...

Google Chrome 72.0.3626.119 - 'FileReader' Use-After-Free (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Chrome 72.0.3626.119 FileReader UaF exploit for Windows 7 x86', 'Description' = %q This exploit takes advantage of a use after free vulnerability...

Use-After-Free (UAF)

Firefox, Firefox ESR and Thunderbird are vulnerable to use-after-free vulnerability. Errors in the handling of node adoption while manipulating DOM events and removing audio elements could possibly result in a system crash...

One_gadget and UAF combined with the use of a heap overflow vulnerability research-exploit warning-the black bar safety net

! Overview: through a simple ROP topics understanding Onegadget works, then use it to provide the ROP chain to achieve a heap of UAF vulnerabilities. Stack Overflow as a CTF pwn a big question, very worthy of study. The present article is for a certain Stack Overflow, and the stack use of the...

Apache 2.4.17 2.4.38 - apache2ctl graceful logrotate Local Privilege Escalation

Apache 2.4.17 2.4.38 - apache2ctl graceful logrotate Local Privilege Escalation ?php CARPE DIEM: CVE-2019-0211 Apache Root Privilege Escalation Charles Fol @cfreal 2019-04-08 INFOS https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-local-root.html USAGE 1. Upload exploit to Apache HTTP serv...

CARPE (DIEM) Apache 2.4.x Local Privilege Escalation

?php CARPE DIEM: CVE-2019-0211 Apache Root Privilege Escalation Charles Fol @cfreal 2019-04-08 INFOS https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-local-root.html USAGE 1. Upload exploit to Apache HTTP server 2. Send request to page 3. Await 6:25AM for logrotate to restart Apache 4...

WebKitGTK+ - ThreadedCompositor Race Condition Exploit

@keyframes foo 0% opacity: 0; 100% opacity: 1; div animation-name: foo; animation-duration: 1s; animation-iteration-count: infinite; filter: saturate50%; frame = document.createElement"iframe"; setInterval = frame.remove; document.body.appendChildframe; doc = frame.contentDocument;...

WebKitGTK+ - 'ThreadedCompositor' Race Condition

@keyframes foo 0% opacity: 0; 100% opacity: 1; div animation-name: foo; animation-duration: 1s; animation-iteration-count: infinite; filter: saturate50%; frame = document.createElement"iframe"; setInterval = frame.remove; document.body.appendChildframe; doc = frame.contentDocument;...

WebKitGTK+ - ThreadedCompositor Race Condition

WebKitGTK+ - ThreadedCompositor Race Condition @keyframes foo 0% opacity: 0; 100% opacity: 1; div animation-name: foo; animation-duration: 1s; animation-iteration-count: infinite; filter: saturate50%; frame = document.createElement"iframe"; setInterval = frame.remove;...

CVE-2019-5786: chrome in the wild exploit 0day vulnerability alerts-a vulnerability alert-the black bar safety net

! 0x00 vulnerability background Beijing 3 month 6 days, 360CERT monitoring to chrome release version update72.0.3626.119-72.0.3626.121, fixes in the wild using CVE-2019-5786。 The vulnerability to harm is more serious, a greater impact. 0x01 vulnerability details CVE-2019-5786 is located on the...

Immunity Canvas: DESTROYCLASS_UAF_LPE

Name| destroyclassuaflpe ---|--- CVE| CVE-2019-0623 Exploit Pack| CANVAS Description| DestroyClass UAF LPE Notes| CVE Name: CVE-2019-0623 Notes: Tested: - Windows 7 x64 VENDOR: Microsoft CVE Url: https://nvd.nist.gov/vuln/detail/CVE-2019-0623 CVSS: 10.0...

WebKit JSC JIT - GetIndexedPropertyStorage Use-After-Free Exploit

/ The doesGC function simply takes a node, and tells if it might cause a garbage collection. This function is used to determine whether to insert write barriers. But it's missing GetIndexedPropertyStorage that can cause a garbage collection via rope strings. As a result, it can lead to UaF. PoC: ...

Microsoft Windows 10 - RestrictedErrorInfo Unmarshal Section Handle Use-After-Free Exploit

Windows: RestrictedErrorInfo Unmarshal Section Handle UAF EoP Platform: Windows 10 1709/1809 Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The WinRT RestrictedErrorInfo doesn’t correctly check the validity of a handle to a section...

Microsoft Windows 10 - 'RestrictedErrorInfo' Unmarshal Section Handle Use-After-Free

Windows: RestrictedErrorInfo Unmarshal Section Handle UAF EoP Platform: Windows 10 1709/1809 Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria: User boundary Summary: The WinRT RestrictedErrorInfo doesn’t correctly check the validity of a handle to a section...

WebKit JSC JIT Use-After-Free

WebKit: JSC: JIT: GetIndexedPropertyStorage can GC CVE-2018-4442 The doesGC function simply takes a node, and tells if it might cause a garbage collection. This function is used to determine whether to insert write barriers. But it's missing some cases such as StringCharAt, StringCharCodeAt and...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. Local users are able to exploit a race condition in the ALSA subsystem to crash the application via malicious /dev/snd/seq ioctl calls. The crash is a result of a use-after-free UAF bug in sndseqioctlcreateport...