gobee

gobee Write your BPF programs in Go, not C. gobee transpiles a strict subset of Go into BPF C, generates typed Go bindings for the userspace side, and gates loads against the running kernel. The Go ecosystem has solid userspace tooling for BPF. The kernel side has always ended with "now write you...

CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: One Byte in the BPF Verifier to Container Escape I found a soundness bug in the Linux BPF verifier - a + 1 in a pushstack call that causes the verifier to skip an ALU instruction on a forked path. For BPFOR, this means the verifier tracks dst = 0 while the CPU computes 0 | K = K. ...

jailer

Jailer - eBPF Mandatory Access Control Warning : This project is under heavy development and is NOT ready for production use. APIs, policy formats, and behavior may change without notice. Use for testing and experimentation only. Acknowledgments Note : This is an independent implementation and is...

CVE-2017-16995-Linux-Kernel---BPF-Sign-Extension-Local-Privilege-Escalation-

This repository does not have a README...

CVE-2020-8835

CVE-2020-8835 In the Linux kernel 5.5.0 and newer, the bpf verifier kernel/bpf/verifier.c does not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. This vulnerability also affects the Linux 5.4 stable series, starting with...

cve-2017-16995

CVE-2017-16995 Writeup The folder containes a line-by-line source code analysis for CVE-2017-16995 Linux BPF local privilege escalation. Exploit and patch tested on kernel 4.4.0.116. Credits Special thanks to difengtang who has also contributed this writeup. Exploit scripts was created by @iBearc...

kafel

WHAT IS IT? Kafel is a language and library for specifying syscall filtering policies. The policies are compiled into BPF code that can be used with seccomp-filter. This is NOT an official Google product. Usage With verbose error reporting struct sockfprog prog; kafelctxtt ctxt = kafelctxtcreate;...

cve-2020-35498-flag

cve-2020-35498-flag Flag the cve-2020-35498 attack Build Requires gcc and go. make Filter The filter was built with bpfasm and placed in filter.c. Catch the vulnerability with sudo ./target/catch Trigger with Trigger the vulnerability through interface wlan0 with destination aa:bb:cc:dd:ee:ff. su...

filterforge

filterforge Python toolkit for reverse-engineering Berkeley Packet Filter BPF bytecode. Given raw BPF instructions — the kind you might extract from a malware sample, a packet capture filter, or a network appliance — filterforge disassembles them into human-readable form, uses Z3 to solve for the...

CVE-2021-29155

This is the Proof Of Concept code for CVE-2021-29155. The range tracking system for pointer arithmetic in the speculative domain was insufficient. It was possible to extract kernel data via a sidechannel. This is a proof of concept you can read up to 0x5fff bytes out of bounds from the last eleme...

firejail

Firejail Firejail is a lightweight security tool intended to protect a Linux system by setting up a restricted environment for running potentially untrusted applications. More specifically, it is an SUID sandbox program that reduces the risk of security breaches by using Linux namespaces,...

PS4-5.05-Kernel-Exploit

PS4 5.05 Kernel Exploit Summary In this project you will find a full implementation of the second "bpf" kernel exploit for the PlayStation 4 on 5.05. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This exploit also contains...

Z-Jail

Z-Jail Multi-layer sandbox for native code execution on Linux. Seven independent defence layers — no external dependencies, 73 KiB PIE binary. ┌──────────────────────────────────────────────────────┐ │ Z-Jail │ ├──────────────────────────────────────────────────────┤ │ Truthimatics PV...

libpcap

LIBPCAP 1.x.y by The Tcpdump Group To report a security issue please send an e-mail to [email protected]. To report bugs and other problems, contribute patches, request a feature, provide generic feedback etc please see the guidelines for contributing. The documentation directory has README...

ScreenOff

ScreenOff CVE-2026-52910 kernel crash poc. ref: https://github.com/5unkn0wn/security-research/tree/CVE-2026-52910ltscosmitigation what socket + SOATTACHREUSEPORTCBPF + setsockopt race. timerfd/epoll callback storm slows down the receive path. replace the cBPF filter while the old prog is still in...

IPCDump

ipcdump Announcement post ipcdump is a tool for tracing interprocess communication IPC on Linux. It covers most of the common IPC mechanisms -- pipes, fifos, signals, unix sockets, loopback-based networking, and pseudoterminals. It's a useful tool for debugging multi-process applications, and it'...

CVE-2021-33624

Proof of Concept for CVE-2021-33624 compile with gcc -pthread -o bpfspectretypeconfusion bpfspectretypeconfusion.c -Wall -ggdb -std=gnu99 execute with sudo ./bpfspectretypeconfusion 1 2 ffffffffa4925620 0x10 where 1 and 2 are CPU threads which run on two distinct hardware cores, ffffffffa4925620 ...

seccomp-tools

Seccomp Tools Des outils puissants pour l'analyse seccomp. Ce projet vise principalement mais pas exclusivement l'analyse des sandboxes seccomp dans les défis pwn de CTF. Certaines fonctionnalités sont spécifiques aux CTF, mais elles sont tout aussi utiles pour analyser des filtres seccomp réels...

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system...

PT-2026-106549

In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scx bpf select cpu and and scx bpf dsq insert vtime refuse the call and report to @p's...