CVE-2026-36425

CVE-2026-36425 : OPSWAT AppRemover 任意プロセス終了 署名されたOPSWATカーネルドライバで、要求に応じて任意のプロセスを強制終了します。管理者権限不要、権限チェックなし、問答無用。EDR、アンチウイルス、PPLで保護されたプロセスを指定すると、即座に終了します。3種類の異なる強制終了方法があり、すべてカーネルモードで実行され、任意のローカルユーザーからの単一のIOCTLでトリガーされます。脆弱なドライバのバリアントが16個特定され、すべて有効な署名が付与されています。 ⚠️...

CVE-2026-89877

A flaw was found in the saa7164 media driver in the Linux kernel. When the saa7164devsetup function fails to allocate PCI BAR memory regions, it incorrectly leaves a dangling entry on the global device list. This improper cleanup of resources can lead to a resource leak, potentially allowing a...

CVE-2026-90422

A flaw was found in the Linux kernel. When the mtkclkregisterpllfhs function, part of the MediaTek Phase-Locked Loop PLL clock driver, fails to register a PLL, it does not properly free the input/output IO memory mapped on the fhctl node. This oversight leads to a memory leak. Over time, repeated...

CVE-2026-90287

A flaw was found in the Linux kernel's Sunplus PHY Physical Layer driver. Improper error handling within the spuphyinit function could lead to the leakage of clock and reset resources. This resource exhaustion could potentially be exploited by a local attacker, resulting in a Denial of Service Do...

CVE-2026-90007

A flaw was found in the Linux kernel's pm8001 SCSI driver. When pm8001requestmsix attempts to free Message Signaled Interrupts MSI-X vectors, it uses an incorrect index during the rollback process. This error prevents previously registered interrupt handlers from being properly deallocated, leadi...

CVE-2026-89896

A flaw was found in the Linux kernel's Cedrus media driver. The cedrusinitctrls function, responsible for initializing V4L2 Video for Linux Two control handlers, does not properly free allocated resources if a subsequent memory allocation fails. This oversight can lead to a memory leak, potential...

CVE-2026-89889

A flaw was found in the Linux kernel's i2c imx415 media driver. When programming VMAX fails, the VBLANK path returns immediately without releasing a previously acquired runtime power management PM reference. This oversight can lead to a resource leak, potentially allowing a local attacker to caus...

CVE-2026-90015

A flaw was found in the Linux kernel's xHCI eXtensible Host Controller Interface driver. This vulnerability occurs when the driver processes large, fragmented USB data transfers, leading to incorrect handling of memory buffers. An attacker with local access or a malicious USB device could exploit...

CVE-2026-93102

A flaw was found in the Linux kernel's RDMA/hfi1 driver. During a late probe failure, the hfi1initdd function allocates shared RX support, but if subsequent initialization or device registration fails, the allocated memory is not properly freed. This oversight can lead to a memory leak, potential...

CVE-2019-16098

CVE-2019-16098 このCVEはRTCore64.sysドライバを悪用し、Systemプロセスのトークンを低権限のcmd.exeプロセスにコピーすることで、システム権限を持つcmd.exeプロセスを作成します。 アプローチと方法論に関するブログはこちらをご覧ください。...

CVE-2025-7771-Vulnerability-Exploration

🔓 ThrottleStop.sys カーネルエクスプロイト — HVCI互換の物理メモリマッパー CVE-2025-7771 — ThrottleStop.sys IOCTLによる任意物理メモリ読み取り/書き込み ⚠️ 免責事項 このプロジェクトは教育および研究目的のみ で公開されています。その目的は、署名された信頼済みカーネルドライバーが、AdministratorからSYSTEM/カーネル へのローカル特権昇格LPEのために悪用され得ることを実証し、HVCIハイパーバイザー適用コード整合性や...

MiniPlasma-Runner

MiniPlasma-Runner Nightmare-Eclipse/MiniPlasma CVE-2020-17103의 수정 버전으로, C2 사용에 맞게 조정되었습니다. 원래 PoC는 디스크에서만 실행됩니다. 이 버전은 execute-assembly를 통해 메모리에서 완전히 실행되며, 이진 파일을 분할하여 탐지를 회피합니다. 면책 조항 이 도구는 승인된 보안 테스트 및 교육 목적으로만 제공됩니다. 명시적인 서면 허가 없이 시스템에 대해 이 도구를 사용하는 것은 불법이며 비윤리적입니다. 저자는 이 도구의 오용 또는 손해에 대해 어떠한...

CVE-2026-93145

A flaw was found in the Linux kernel's Qualcomm QCOM Generic Power Domain Controller GDSC driver. When a GDSC provider is unregistered, the driver fails to properly remove generic power domain entries from a global list. This oversight can lead to dangling entries, causing subsequent attempts to...

CVE-2026-90415

A flaw was found in the Linux kernel's RDMA/cxgb4 driver. This vulnerability occurs when the system fails to properly free a Steering Tag STAG index after an unsuccessful attempt to write to adapter memory. This leads to a resource leak, which could be exploited by a local attacker to cause a...

CVE-2026-90239

A flaw was found in the Linux kernel's AMD ISP4 driver. When allocating GPU memory, the isp4ifallocfwgpumem function fails to release partially allocated memory pools if an error occurs during the process. This memory leak could lead to system instability or a Denial of Service DoS over time, as...

CVE-2026-90233

A flaw was found in the Linux kernel's nvme-pci driver. This vulnerability occurs when descriptor Direct Memory Access DMA pools are created during device probing but are not properly released if the probe operation fails. This oversight leads to a memory leak, where dmapool objects are not freed...

Driver-RW

Driver-RW CVE-2018-19321을 이용하여 NT AUTHORITY\SYSTEM으로 권한 상승 WIndows 10 v1511에서 테스트됨...

CVE-2014-4322

poc 코드는 Nexus 5 Android 4.4.4에서 작동합니다. 권한 상승：system→root, https://github.com/koozxcv/CVE-2014-7911-CVE-2014-4322getrootprivilege 의 일부 저자：andy 웹사이트：https://blog.csdn.net/koozxcv 익스플로잇은 system 권한과 몇 가지 특정 SELinux 컨텍스트에서 실행되어야 합니다. 익스플로잇이 성공하면 root 권한과 "kernel" SELinux 컨텍스트를 얻습니다. 버그 정보...

cve-2021-43226PoC

CVE-2021-43226 재현 환경 운영 체제: Hyper-V의 Win10 20H2 빌드 번호 19042.508, 웹사이트 https://os.click/en 발견, Windows 이미지가 비교적 완전하고 아직 백도어를 발견하지 못했습니다. 찾은 PoC는 Visual Studio 2013으로 컴파일되었기 때문에 저도 Visual Studio 2013을 사용하여 정적으로 링크했습니다. 취약점 취약점은 clfs.sys 의 CClfsLogFcbVirtual::QueryLogFileInfo 함수에 있습니다. clfs.sys는...

OPENSUSE-SU-2026:22022-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: Security issues fixed: - CVE-2026-78807: missing validation in driver-based PMKSA selection within wpasupplicant can allow local security bypasses bsc1280914...