CVE-2022-0995

CVE-2022-0995 This is my exploit for CVE-2022-0995, an heap out-of-bounds write in the watchqueue Linux kernel component. It uses the same technique described in https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html. The exploit targets Ubuntu 21.10 with kernel...

CVE-2021-22555-Exploit

CVE-2021-22555-एक्सप्लॉइट CVE-2021-22555 एक्सप्लॉइट एंडी गुयेन द्वारा जानकारी एक हीप आउट-ऑफ-बाउंड्स राइट जो Linux v2.6.19-rc1 के बाद से प्रभावित कर रहा है, net/netfilter/xtables.c में खोजा गया। यह एक हमलावर को उपयोगकर्ता नाम स्थान के माध्यम से विशेषाधिकार प्राप्त करने या DoS हीप मेमोरी भ्रष्टाचार...

Exploit for Out-of-bounds Write in Apple Ipados

🛡️ CVE-2026-86950 — CoreGraphics Security Research...

kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

Astra Linux – Vulnerability in NTP

In the mstolfp.c file within NTP 4.2.8p15, there is a buffer overflow vulnerability when adding a decimal point. An adversary may be able to attack a client’s ntpq process, but they cannot attack the ntpd process...

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

FFmpeg before version 8.1 has an integer overflow, resulting in an out-of-bounds write operation through CENC Common Encryption subsample data into libavformat/mov.c...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: udf: The validation of the sparing table length is performed based on the number of entries, not the number of bytes. The udfloadsparablemap function accepts a sparing table when the condition sizeofst +...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: The capacity of the Dirty Page Table is validated during the logreplay copylcns operation. During the analysis phase of the $LogFile journal replay process, logreplay copies LCNs from each action log record into an...

Astra Linux – Vulnerability in Chromium

Before version 92.0.4515.131, writing out-of-bounds data using Tab groups in Google Chrome allowed an attacker who convinced a user to install a malicious extension to perform an out-of-bounds memory write via a crafted HTML page...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput function selects a count of 2 whenever the transfer speed is slower than high speed. It never relates this count to ep-maxtransfer. The URB buffe...

Astra Linux – Vulnerability in libfastjson

JSON-C version 0.14 has an integer overflow issue, and there is a risk of out-of-bounds write operations through a large JSON file, as demonstrated by the printbufmemappend function...

Astra Linux – Vulnerability in Cairo

A flaw was discovered in cairo’s image-compositor.c in all versions prior to 1.17.4. This flaw allows an attacker who can provide a crafted input file to cairo’s image-compositor for example, by convincing a user to open a file in an application that uses cairo, or if an application uses cairo on...

Astra Linux – Vulnerability in dcmtk

There is an improper array index validation vulnerability in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: The bound NTFSDEdeview.dataoff was bound in UpdateRecordDataRoot,Allocation. In the UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 functions, the destination of the memmove operation is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fixed a heap overflow in the NFSv4.0 LOCK replay cache. The NFSv4.0 replay cache uses a fixed 112-byte inline buffer rpibufNFSD4REPLAYISIZE to store encoded operation responses. This size was calculated based on OPEN...

Astra Linux – Vulnerability in unbound

Before version 1.9.5, Unbound allowed an out-of-bounds write operation through a compressed name in rdatacopy. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, an ongoing Unbound installation cannot be remotely or locally exploited...

Astra Linux – Vulnerability in WebKit2GTK

A out-of-bounds write issue has been addressed through improved input validation. This issue is fixed in iOS 15.6, iPadOS 15.6, watchOS 8.7, tvOS 15.6, macOS Monterey 12.5, and Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: SOF: ipc3-control: Fixed a heap overflow in bytesext put/get The ipccontroldata buffer is allocated using kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata, including its flexible array payload...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: nfc: fdp: Bound the device-reported read length and fixed an skb leak. fdpncii2cread takes the next packet length from two bytes provided by the device and does not validate it. This value is used as the count for i2cmasterrec...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: tls: In the tls.AppendFrag function, there is a potential out-of-bounds write vulnerability. This issue was detected using syzkaller and a local syzbot instance running on top of a netdevsim TLS offload emulation. The...