leaky-vessels-dynamic-detector

ADVERTENCIA Este repositorio está ahora archivado. No se realizarán más actualizaciones al código y puede ser inseguro o incluso estar roto para cuando leas este aviso. Considéralo solo con fines históricos y trátalo con cuidado. Detector Dinámico de Leaky Vessels En este repositorio encontrarás...

CVE-2026-48496 opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block...

CVE-2026-48496

OpenTelemetry eBPF Profiler (versions 0.0.202527 through before 0.0.202622 ) is vulnerable to a denial of service triggered by a local, unprivileged process. The root cause is that the profiler can be induced to open a nonregular mapping file (such as a FIFO), which causes it to block indefinitel...

kestrel

The kernel-level visibility of Falco, with the live UI the kernel-native tools don't ship. Quickstart · Spec · Views · Roadmap Kestrel traces kernel events process exec, file access, network connections with an eBPF agent and streams them to a SvelteKit web app that renders a live activity feed,...

teler

!IMPORTANT Dear users, We wanted to share some important updates regarding the development of teler IDS. 🛑 The development of teler IDS is currently on hold. However, we're thrilled to inform you that we've decided to take a bold step by embarking on a complete refactor, starting from scratch to...

eBPF-hid_guard

eBPF-hidguard See Why This Was Archived below. A Linux kernel-space security monitor for detecting and blocking HID injection attacks Rubber Ducky, O.MG Cable, ESP32-based keyboard emulators using eBPF HID-BPF structops. What This Does Malicious HID devices emulate keyboards and inject keystrokes...

ebpf

Herramientas eBPF Misceláneas...

blackpill

BlackPill BlackPill 是一个用 Rust 编写的隐秘 Linux 内核工具包。 特性 该内核工具包由多个模块组成（这里指的是 Rust 模块，而非内核模块）： 防御规避 ：隐藏文件、进程、网络连接等。 钩子 ：挂钩系统调用和中断描述符表 IDT。 虚拟机监控器 ：创建虚拟机以执行恶意代码。 持久化 ：使内核工具包在重启后仍可持久化，并具备抗清除能力。 工具 ：各种实用工具。 架构如下所示： 以下是恶意代码从 C2 执行到虚拟机客户机的过程： C2 将精心构造的 x8664...

CVE-2026-31431-mitigation-suite

AFALG Defense Framework A kernel-runtime defense framework for the Linux AFALG Address Family Algorithm, family 38 subsystem. Built for Security Operations Centers running enterprise Linux fleets where Zero Trust must extend into the kernel, not stop at the network edge. Why AFALG matters to a SO...

wg.copyfail.patch

CVE-2026-31431 aka Copy.Fail eBPF workaround Why it matters This CVE allows authorized user change cache copy of any readable file, which leads to Local Privilege Escalation aka local root exploit, sandbox/container escape and other issues. It works by creating AFALG socket that is provided by...

CVE-2025-39913

CVE-2025-39913 - Linux Kernel eBPF SOCKMAP UAF Author: Byte Reaper My platform :https://www.bytrep.com/ Description This repository contains a technical proof-of-concept for CVE-2025-39913, a vulnerability in the Linux kernel's tcpbpfsendverdict function. When bpfmsgcorkbytes fails to allocate...

grlh

disable ebpf verifier with this one weird trick as seen on twitter.com https://twitter.com/bleidl/status/871527499984982016...

CVE-2022-23222-POC

Proof of Concept Exploit Code for CVE-2022-23222 This is a POC for CVE 2022-23222, a Local Privilege Escalation vulnerability. This POC was written for Ubuntu 20.04 with kernel version 5.13.0-27-generic, but other kernel versions are also vulnerable. For a detailed analysis of the exploit, please...

CVE-2026-31431-mitigation

CVE-2026-31431-mitigation This repository holds the source code for our eBPF-based mitigation against CVE-2026-31431, also known as "copy.fail". More info available at https://copy.fail The motivation behind building this solution was to fulfill the need for a reboot-less mitigation for...

CVE-2022-23222

CVE-2022-23222 Chinese writeup: https://tr3e.ee/posts/cve-2022-23222-linux-kernel-ebpf-lpe.txt For educational/research purposes only. Use at your own risk. Build & Run root@kitploit: $ make cc -I include -static -w -o exploit exploit.c $ ./exploit phase1/8 'create bpf maps' running + phase1/8...

CVE-2021-3490

The eBPF ALU32 bounds tracking for bitwise ops AND, OR and XOR in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. Compile: gcc -o pwn pwn.c && gcc -o exploit exploit.c...

FRAGNESIA-Charan-cve-2026-46300

Charantej Architecture: Hardened Container Staging & Syscall Telemetry Lab An enterprise-grade, defense-in-depth container containment and runtime security telemetry framework. Designed from the perspective of a Cisco Lead Cybersecurity Architect, the Charantej Architecture isolates staging...

container-escape-ebpf

White Paper https://www.scs-europe.net/dlib/2026/2026-0321.html Assumptions Host runs vulnerable version of runc: For CVE-2025-31133: 1.2.7 and below, 1.3.0-rc.1 through 1.3.2, 1.4.0-rc.1 and 1.4.0-rc.2. For CVE-2024-21626: 1.0.0-rc93 through 1.1.11. Unprivileged user is able to create containers...

CVE-2026-53671

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a TCTX-typed base register as a silent no-op: domemstore in src/crab/ebpftransformer.cpp only models TSTACK stores, and the...

CVE-2026-53670

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...