CVE-2025-40019-POC

CVE-2025-40019에 대한 개념 증명 CVE-2025-40019는 Encrypted Salt-Sector Initialization Vector 메커니즘crypto/essiv.c에서 Associated Authentication DataAAD 길이에 대한 검증이 초기화 벡터IV 크기와 비교하여 충분하지 않아, 메모리 경계를 넘어 접근하는 취약점입니다. 이 저장소에 제공된 코드는 단순한 버그 트리거이지만, 이 버그는 쉽게 악용될 수 있습니다. KernelCTF 항목 이 버그를 kernelctf 스프레드시트 여기에서...

TokenMan

アクセス トークンと更新トークンのスイート。 Token Man は、AAD のアクセス トークンおよび／または更新トークンを使用したポストエクスプロイテーション活動を支援するツールです。 目次 使い方 コマンド Fetch Search Swap FOCI アプリケーション クライアント ID マップ AZ OAuth 使い方 usage: tokenman.py -h fetch,search,swap,az,oauth ... Token Man -- v0.1.1 positional arguments: fetch,search,swap,az,oauth Command...

azbelt

azbelt Azure関連の認証情報、主にAAD参加済みマシンでの列挙を行うためのスタンドアロンDLLおよびsliver拡張機能 モジュール aadjoin - NetGetAadJoinInformation を介してマシンのAADステータスに関する情報を取得 credman - 資格情報マネージャーから資格情報を取得 env - シークレットを含む可能性のあるAzure/AAD固有の環境変数を探す managed - IMDSエンドポイントを呼び出して、マネージドIDを持つマシンに関する情報を取得 msal -...

Azure-AccessPermissions

Azure-AccessPermissions Azure Active Directory 환경에서 액세스 권한을 열거하기 위한 사용하기 쉬운 PowerShell 스크립트입니다. 자세한 배경 내용은 관련 블로그 게시물에서 확인할 수 있습니다: Azure Active Directory 사용자 및 액세스 권한 정리 Azure Active Directory 권한 정리 II: 권한 있는 액세스 요구 사항 이 스크립트를 실행하려면 다음 두 가지 PowerShell 모듈이 필요합니다: Microsoft.Graph AADInternals...

SUSE CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832

CVE-2026-80832 is a buffer underallocation flaw in the Linux kernel's QCE (Qualcomm Crypto Engine) crypto driver , specifically in qce_aead_ccm_prepare_buf_assoclen(). The AAD buffer size is computed as ALIGN(assoclen, 16) + MAX_CCM_ADATA_HEADER_LEN, while the DMA scatterlist length uses ALIGN(as...

EUVD-2026-71282

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832 crypto: qce - fix CCM AAD buffer underallocation

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-80832 crypto: qce - fix CCM AAD buffer underallocation

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

Linux Distros Unpatched Vulnerability : CVE-2026-80832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into t...

PT-2026-85710

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qce aead ccm prepare buf assoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated...

openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

A flaw was found in OpenSSL. The implementations of AES-SIV Advanced Encryption Standard - SIV and AES-GCM-SIV Advanced Encryption Standard - Galois/Counter Mode - SIV incorrectly process authentication tags for empty messages. This vulnerability allows a remote attacker to forge empty messages...

GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

JLSEC-2026-1144 Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the...

Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional Authenticated Data with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is present, so with no AAD the G1 block nonce, length, flag is never mixed into the MAC and...

CVE-2026-12803

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-12803 KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...