18 matches found
DirtyCred
DirtyCred：Linux 内核中的权限提升 DirtyCred 是一种内核漏洞利用概念，它将非特权内核凭据与特权凭据进行交换，从而提升权限。DirtyCred 并非覆写内核堆上的任何关键数据字段，而是滥用堆内存复用机制来获得特权。尽管这一概念很简单，却非常有效。更多详情请参阅 Blackhat 演示文稿或 CCS 论文。 利用效果 仅数据 ：无需绕过 KASLR 或泄漏内核堆。 通用 ：使用 DirtyCred 编写出的漏洞利用程序可在不同内核与架构上运行。 有效 ：可绕过上游内核中所有可用的漏洞利用缓解措施。 演示 CVE-2021-4154 CVE-2022-2588...
CVE-2024-40431-CVE-2022-25479-EOP-CHAIN
CVE-2024-40431+CVE-2022-25479 체인 EOPDATA ONLY ATTACK 한 현명한 사람이 말하길 "그 집세는 너무 비싸다"와 "공은 공을 줘야 한다"라고 했습니다. https://x.com/zwclose 에게 경의를 표하며, 그는 이 2개의 버그에 대한 PoC를 찾아 공개했습니다. 우리reubensammut와 vlad그에게 공손히 요청하여 그의 PoC를 데이터 전용 공격으로 약간 수정하여 결국 EOP로 이어지게 했습니다 :...
CVE-2025-38001
CVE-2025-38001 RBTree 가족 드라마 Linux HFSC Eltree Use-After-Free - Debian 12 PoC 이 PoC는 RBTree 변환을 기반으로 한 페이지 수준의 데이터 전용 공격을 사용하여 시스템을 손상시킵니다. 이 익스플로잇은 모든 kernelCTF 인스턴스LTS 6.6.90, COS 109, COS 105 및 Debian 12에서 이식 가능하며 작동합니다. Ubuntu LTS에서는 Kmalloc Random Caches로 인해 약간의 수정만 필요합니다. 취약점 분석 및 익스플로잇 개발:...
HVCIPwned
CVE-2024-35250 Windows Kernel Streaming ドライバー ks.sys における信頼されないポインタの逆参照によるローカル権限昇格。 データのみのエクスプロイト — ハイパーバイザーで保護されたコード整合性 HVCI をバイパスします。 概要 項目| 詳細 ---|--- CVE| CVE-2024-35250 コンポーネント| ks.sys Kernel Streaming バグ種別| 信頼されないポインタの逆参照 影響| NT AUTHORITY\SYSTEM への権限昇格 EoP HVCI| 回避 — カーネル内でのコード実行なし パッチ|...
ghostlock-aresin
GhostLock CVE-2026-43499 — POCO F3 GT aresin MediaTek Dimensity 1200（MT6893）向けのデータのみの physmap 上書きエクスプロイト。 カーネル: 4.14.186-android13 / MIUI V14.0.4.0.TKJCNXM。 ⚠️ 前提条件 デバイス : POCO F3 GT / Redmi K40 Gaming Edition codename: aresin チップ : MediaTek Dimensity 1200 MT6893 システム : Android 13 / MIUI 14...
CVE-2026-64563_EXP
CVE-2026-64563EXP 実験研究のみを目的としています。prefetchとnpermのコード（設定が必要なメモリ参照set.gdb）は添付されておらず、最適化も行われていないため、命中確率は低いです。 著者は、この脆弱性の作者が関連情報をすでに公開していることに注目しています：https://github.com/google/security-research/pull/414...
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
Summary Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user's browser issue attacker-chosen outbound GET...
Exploit for Use After Free in Linux Linux_Kernel
GhostLock CVE-2026-43499 – Redmi K70 Ultra rothko A data-...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: powerpc64/ftrace: fixed the issue of module loading without patchable function entries. getstubssize assumes that there must always be at least one patchable function entry, which is not always the case modules that export dat...
EEF-CVE-2026-43968 CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1
Summary Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in ninenines cowlib allows SSE event splitting and injection via unvalidated field values. cow\sse:event/1 in cowlib guards the id and event fields against \n but not against bare \r, and the internal prefix\lines/2...
From Extortion to E-commerce: How Ransomware Groups Turn Breaches into Bidding Wars
Ransomware has evolved from simple digital extortion into a structured, profit-driven criminal enterprise. Over time, it has led to the development of a complex ecosystem where stolen data is not only leveraged for ransom, but also sold to the highest bidder. This trend first gained traction in...
SUSE CVE-2025-37898
In the Linux kernel, the following vulnerability has been resolved: powerpc64/ftrace: fix module loading without patchable function entries getstubssize assumes that there must always be at least one patchable function entry, which is not always the case modules that export data but no code,...
SUSE CVE-2025-37863
In the Linux kernel, the following vulnerability has been resolved: ovl: don't allow datadir only In theory overlayfs could support upper layer directly referring to a data layer, but there's no current use case for this. Originally, when data-only layers were introduced, this wasn't allowed, onl...
Exploit for Use After Free in Linux Linux_Kernel
CVE-2024-0582 A data-only attack based on CVE-2024-0582 De...
Exploit for Missing Release of Memory after Effective Lifetime in Realtek Rtsper
CVE-2024-40431+CVE-2022-25479 chain for EOPDATA ONLY ATTACK...
Exploit for Heap-based Buffer Overflow in Gnu Glibc
GNU C Library's Dynamic Loader Vulnerability CVE-2023-4911...