setcred

FreeBSD setcred2 — 연구 아티팩트 이 하위 디렉토리는 FreeBSD 14.x 커널의 setcred2 스택 버퍼 오버플로우에 대한 분석 문서와 작동하는 익스플로잇을 수집합니다. 취약점 자체는 setcred.txt에 완전히 문서화되어 있습니다. 간단히 말하면: kernsetcredcopyinsuppgroups는 groups가 gidt 일 때 sizeofgroups를 사용하여 고정 크기 커널 스택 배열로의 copyin에 대해 4바이트가 아닌 8바이트 스트라이드를 생성합니다. 오버플로우는 권한 검사 전에 권한이 없는...

desc_race-1

descrace "descrace"CVE-2021-30955 iOS 15.0 - 15.1.1용 익스플로잇안정적인 커널 r/w 프리미티브 포함 익스플로잇 방법 1. IOSurfaceClient 배열의 용량을 0x2000으로 늘립니다. 목표는 내용이 완전히 제어되는 포인터를 작성한 다음 IOSurfaceRootUserClient 인터페이스를 사용하여 커널 r/w를 달성하는 것입니다. 배열의 크기는 0x2000 8바이트이므로 KHEAPDEFAULT와 동일한 KHEAPKEXT의 large map에 위치합니다. 2. 그런 다음...

CVE-2026-64082 riscv: Fix register corruption from uninitialized cregs on error

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...

CVE-2026-64082

The CVE-2026-64082 issue affects the Linux kernel on riscv where uninitialized cregs data could be written to a task’s pt_regs during error paths. Specifically, compat_riscv_gpr_set() and compat_restore_sigcontext() call cregs_to_regs() unconditionally, even when user_regset_copyin() or __copy_fr...

PT-2026-61399

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where uninitialized stack data is written into a target task's register state during error conditions. In the compat riscv gpr set function, cregs to regs is called...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002504)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002504 advisory. The rawcmdcopyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioc...

CVE-2022-23085

A user-provided integer option was passed to nmreqcopyin without checking if it would overflow. This insufficient bounds checking could lead to kernel memory corruption. On systems configured to include netmap in their devfsruleset, a privileged process running in a jail can affect the host...

CVE-2022-23084

The total size of the user-provided nmreq to nmreqcopyin was first computed and then trusted during the copyin. This time-of-check to time-of-use bug could lead to kernel memory corruption. On systems configured to include netmap in their devfsruleset, a privileged process running in a jail can...

SUSE CVE-2004-2731

Multiple integer overflows in Sbus PROM driver drivers/sbus/char/openprom.c for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying 1 a small buffer size to the copyinstring function or 2 a negative buffer...

The vulnerability of the nmreq_copyin() function in the netmap component of FreeBSD allows a hacker to execute arbitrary code in the kernel context.

The vulnerability of the nmreqcopyin function in the netmap component of FreeBSD operating systems is caused by a numerical overflow. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the kernel context...

PT-2022-6122 · Freebsd · Freebsd

Name of the Vulnerable Software and Affected Versions: FreeBSD affected versions not specified Description: The issue is related to a time-of-check to time-of-use bug in the nmreq copyin function of the netmap component in FreeBSD. This bug could lead to kernel memory corruption. On systems...

Apple iOS - Kernel Stack Memory Disclosure due to Failure to Check copyin Return Value

Apple iOS - Kernel Stack Memory Disclosure due to Failure to Check copyin Return Value Here's a code snippet from sleh.c with the second level exception handler for undefined instruction exceptions: static void handleuncategorizedarmsavedstatet state, booleant instrLen2 exceptiontypet exception =...

Apple iOS Kernel - Stack Memory Disclosure due to Failure to Check copyin Return Value Exploit

Exploit for iOS platform in category dos / poc Apple iOS - Kernel Stack Memory Disclosure due to Failure to Check copyin Return Value Exploit Here's a code snippet from sleh.c with the second level exception handler for undefined instruction exceptions: static void handleuncategorizedarmsavedstat...

Apple iOS - Kernel Stack Memory Disclosure due to Failure to Check copyin Return Value

Here's a code snippet from sleh.c with the second level exception handler for undefined instruction exceptions: static void handleuncategorizedarmsavedstatet state, booleant instrLen2 exceptiontypet exception = EXCBADINSTRUCTION; machexceptiondatatypet codes2 = EXCARMUNDEFINED; machmsgtypenumbert...

Oracle Re-Patches Decade-Old Solaris Bug

Oracle has issued three fixes for a critical Solaris vulnerability that could allow kernel-level privilege escalation. Impacted are the Solaris 10 and 11.3 operating environments. Sun Microsystems now owned by Oracle originally patched the vulnerability in 2009. But, a “re-fix” is now required,...

Apple XNU Kernel - Memory Corruption due to Integer Overflow in __offsetof Usage in posix_spawn on 32-bit Platforms

Apple XNU Kernel - Memory Corruption due to Integer Overflow in offsetof Usage in posixspawn on 32-bit Platforms posixspawn is a complex syscall which takes a lot of arguments from userspace. The third argument is a pointer to a further arguments descriptor in userspace with the following structu...

macOS / iOS - Kernel Double Free due to Incorrect API Usage in Flow Divert Socket Option Handling

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1373 SOFLOWDIVERTTOKEN is a socket option on the SOLSOCKET layer. It's implemented by flowdiverttokensetstruct socket so, struct sockopt sopt in flowdivert.c. The relevant code is...

CVE-2016-8661

Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges EoP and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to t...

CVE-2016-8661

Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges EoP and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to t...

Buffer overflow

Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges EoP and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to t...