netfence

Netfence Like Envoy xDS, but for eBPF filters. Netfence runs as a daemon on your VM/container hosts and automatically injects eBPF filter programs into cgroups and network interfaces, with a built-in DNS server that resolves allowed domains and populates the IP allowlist. Netfence daemons can be...

CVE-2022-0492

CVE-2022-0492 Container Escape Analysis toc Vulnerability Overview Vulnerability ID: CVE-2022-0492 Vulnerable Product: linux kernel - cgroup Affected Versions: linux kernel 5.17-rc3 Vulnerability Impact: When a container does not have additional security measures enabled, an attacker with root...

CVE-2022-0492-Docker-Breakout-Checker-and-PoC

CVE-2022-0492 Docker Breakout Checker and PoC Summary Exploiting the vulnerability requires the attacker to have access to a Docker container running on a vulnerable system. Once exploited, the attacker can escape the container and gain complete control over the host system. A vulnerability was...

CVE-2025-38502-Linux-LPE

Abraxas Labs · abraxaslabs.tech · github.com/abraxas · @abraxasnull CVE-2025-38502 Write-up: https://abraxaslabs.tech/research/CVE-2025-38502 Linux kernel BPF cgroup local storage out-of-bounds access via tail calls | ---|--- CVE| CVE-2025-38502 CWE| CWE-125 — Out-of-bounds Read Vendor| Linux...

CVE-2024-21626-POC

CVE-2024-21626-PoC Usage Instructions For educational/research purposes only. Any use unrelated to education/research is at your own risk. Usage docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy Note The specific file descriptors used var...

Hulios

Hulios Hardened Universal Linux Invisibility and Onion System Hulios is an eBPF-powered, transparent Tor VPN gateway for Linux. It secures outbound network traffic by redirecting TCP sockets and DNS queries through an embedded Arti Tor client instance and a localized Hickory-based DNS resolver. B...

CVE-2024-21626-PoC

CVE-2024-21626 Root cause & Proof of Concept How to use poc-autoplay? make install make uninstall 1. Root cause In runc versions ≤ 1.1.11, when opening the host's /sys/fs/cgroup directory to set cgroups, the file descriptor is left open for the container initialization process without closing it,...

docker_escape_pwn

Escape from Docker using CVE-2017-1000112 and CVE-2017-18344. Including: gaining root privilage get all capbilities namespace recovery filesystem recovery cgroup limitation bypass seccomp bypass...

hardstop

Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution Architectural Comparison: Off-Board Hardware Fabrics DPUs / SmartNICs vs. In-Cache Kernel Preemption Hard Stop Off-board hardware security architectures route agent execution telemetry out-of-band across host I/O buses...

CVE-2023-31443

CVE-2023-31443 nordugrid-arc-wn 6.14.0 DoS/LPE. Suggested description NorduGrid nordugrid-arc-wn 6.14.0 has the arc-job-cgroup SUID binary that is vulnerable to a path traversal attack. Combined with a race condition, the attacker can write the ppid to any file as long as the file is writable by...

EulerOS Virtualization 2.15.0 : kernel (EulerOS-SA-2026-4698)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : mm: blk-cgroup: fix use-after-free in cgwbreleaseworkfnCVE-2026-31586 e1000/e1000e: Fix leak in DMA error cleanupCVE-2026-43445...

EulerOS Virtualization 2.15.1 : kernel (EulerOS-SA-2026-4640)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : mm: blk-cgroup: fix use-after-free in cgwbreleaseworkfnCVE-2026-31586 e1000/e1000e: Fix leak in DMA error cleanupCVE-2026-43445...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch In allochugetlbfolio, a single hcg pointer is used for both the rsvd and non-rsvd hugetlb cgroup charges. When mapchg is set, hugetlbcgroupchargecgrouprsvd stores the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcgactivatepolicy When switching IO schedulers on a block device, blkcgactivatepolicy can race with concurrent blkcg deletions, resulting in a use-after-free in rcuacceleratecbs. T1: T2: blkgdestr...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix leaks and online flag on radixtreeinsert failure When radixtreeinsert fails in blkgcreate, the error path has two issues: 1. blkg-online is set to true unconditionally, even when the blkg was never fully inserted...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: schedext: Call cgrouplock first in scxcgrouplock scxcgrouplock writes scxcgroupopsrwsem and then calls cgrouplock, which can lead to a deadlock via kernfs: scx enable/disable cgroup rmdir cpu.weight write ------------------...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocgkickdelay converts sufficiently large debts into explicit block-cgroup delays via blkcgsetdelay, setting blkg-usedelay to -1 and incrementing blkcg-congestioncount...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Strengthen checks on cgroup storage cookies for prog arrays The fix in commit abad3d0bad72 “bpf: Fix oob access in cgroup local storage” is still incomplete. The compatibility check for prog arrays treats a program lacking...

util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush()

A flaw was found in the Linux kernel's block input/output control group blk-cgroup component. This vulnerability, a Use-After-Free UAF, occurs when multiple block control groups are released at the same time. A race condition allows one group to remove another's entries while it is still in use,...