Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: PCI: pnvphp – Fixed issue with surprise plug detection and recovery. The existing PowerNV hotplug code did not handle surprise plug events correctly, resulting in a complete failure of the hotplug system after a device was...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: For the m68k architecture, the bus error is only forced if the PC is not in the exception table. The getkernelnofault function copies data in supervisor mode when forcing a task backtrace log through /proc/sysrqtrigger. This is...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - net: dsa: felix: do not use devres for mdiobus. As explained in the commits: - 74b6d7d13307: “net: dsa: realtek: register the MDIO bus using devres”. - 5135e96a3dd2: “net: dsa: do not allocate the slavemiibus using devres”...

Astra Linux – Vulnerability in Qemu

A reachable assertion issue was detected in the USB EHCI emulation code of QEMU. This issue can occur during the processing of USB requests due to a faulty handling of the DMA memory map. A malicious privileged user within the guest environment may exploit this flaw to send invalid USB requests,...

Astra Linux – Vulnerability in Flatpak

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak applications that had direct access to AFUNIX sockets—such as those used by Wayland, Pipewire, or pipewire-pulse—could trick portals and other host-...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: bcm63xxudc: fixed a memory leak that occurred when using debugfslookup. When calling debugfslookup, the result must be processed by calling dput; otherwise, a memory leak will occur over time. To simplify things, simply call...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: PCI/DPC: Fixed a use-after-free issue when a DPC event occurs concurrently with hot-removal of the same portion of the hierarchy. Keith reported a use-after-free when a DPC event occurred concurrently with the hot-removal of t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Pages may be leaked if setmemoryencrypted fails. In CoCo VMs, it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail, resulting in an error and the shared memory being...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: cihdrcimx: Also search for ‘phys’ handle. When passing ‘phys’ in the device tree to describe the USB PHY handle which is the recommended approach according to Documentation/devicetree/bindings/usb/ci-hdrc-usb2.txt,...

CVE-2025-6019-udisks-lpe-no-image

CVE-2025-6019-udisks-lpe-no-image Cadena de escalada de privilegios solo con script usando CVE-2025-6019 y UDisks2 sin incluir imagen de sistema de archivos. Créditos, Contexto y Cadena de Explotación Este repositorio no introduce una nueva vulnerabilidad. La técnica de escalada de privilegios...

ps5-uart

靠近 salina 的 24 针排针（EDM-010） root@kitploit: emc header 1 5v 2 5v 3 gnd 4 gnd 5 emc gpio a1. 在 emc 启动时拉低会导致 emc rom 进入 uart shell @ 460800 6 uart rx emc 115200 7 uart tx emc 115200 8 3v3，当 emc 复位时变为低电平 9 0v？ 10 gnd 11 titania uart0 tx（efc 固件：460800，eap 固件：691200） 12 titania uart0 rx（efc 固件：460800，e...

Mandating-Honeypots-Project

强制蜜罐项目 随着《父母决定法案》（H.R.8250）和加利福尼亚州《数字年龄保障法案》（议会第1043号法案）等法律在立法机构中推进，隐私、匿名性和数据安全正充斥着系统性威胁，以及带有未经检验攻击面的新安全架构。如果这些立法获得通过，它们将几乎字面意义上地强制要求为坚定的攻击者制造蜜罐，因为任何希望使用计算机的人都必须提供敏感信息（例如政府签发的身份证件）。这不仅危及这些法律声称要保护的未成年人本身，还提供了一个非常明确的攻击面：攻破存储这些数字身份证件的数据库，你就能一下子窃取上千个新身份。...

lpc_sniffer_tpm

用于 ice40 stick 的 TPM 专用 LPC 嗅探器（低引脚数） 将 ice40 stick 转变为 LPC 嗅探器，仅记录 TPM 特定消息。此仓库是 https://github.com/lynxis/lpcsniffer/ 的副本，修改为仅记录起始字段为 0101 且地址介于 24 和 27 之间的消息。 该项目用于在 BitLocker 启用默认配置时通过嗅探 LPC 总线提取 BitLocker VMK 密钥。更多信息请参见 这篇文章。 特性 i/o read + writes memory read + writes sync errors 使用方法 1. 修改...

UBUNTU-CVE-2026-80954

In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev-desc in i3cdevicegetsupportedxfermode i3cdevicegetsupportedxfermode uses dev-desc to obtain the master controller. However, dev-desc must not be dereferenced unless bus-lock is held, and this...

[SECURITY] Fedora 44 Update: PackageKit-1.4.0-1.fc44

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API...

cve-2025-2082

How to Hack a Tesla? — Interactive Scenario Application This project is an interactive cybersecurity scenario based on a real vulnerability discovered by the security firm Synacktiv TPMS → VCSEC → CAN Bus chain. The scenario aims to teach how a Tesla Model 3 could be compromised through a...

CVE-2021-3560

Polkit D-Bus Authentication Bypass Exploit A vulnerability exists within the polkit system service that can be leveraged by a local, unprivileged attacker to perform privileged operations. In order to leverage the vulnerability, the attacker invokes a method over D-Bus and kills the client proces...

[SECURITY] Fedora 45 Update: PackageKit-1.4.0-1.fc45

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API...

cohort-htb

Cohort — writeup de HTB y cadena de explotación Máquina Cohort HackTheBox. Cadena de ataque completa: 1. SSRF en la API Flask /api/validate → descubrimiento de vhost interno 2. RCE pre-auth en el terminal WebSocket de Marimo 0.20.4 CVE-2026-39987 → shell como marimo 3. Escalada de privilegios...

CVE-2026-80954

In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev-desc in i3cdevicegetsupportedxfermode i3cdevicegetsupportedxfermode uses dev-desc to obtain the master controller. However, dev-desc must not be dereferenced unless bus-lock is held, and this...