CVE-2024-21626-runcPOC

Vulnerability Reproduction CVE-2024-21626 docker runc Escape Vulnerability 1. Vulnerability Overview Vulnerability Name| docker runc Escape Vulnerability ---|--- CVE ID| CVE-2024-21626 Disclosure Date| 2024-01-31 Characteristic| / Affected Versions| runc @ v1.0.0-rc93, 1.1.11 2. Exploitation &...

CVE-2024-21626-PoC

CVE-2024-21626 根本原因 & PoC 如何使用 poc-autoplay？ root@kitploit: make install make uninstall 1. 根本原因 runc v1.1.11 及以下版本中，为了设置cgroup而打开主机的 /sys/fs/cgroup 目录时，未关闭该文件描述符并将其保留在容器初始化进程中，从而导致了该漏洞。 1. 在 runc init 阶段，通过主机的 /sys/fs/cgroup 获取 /proc/PID/fd/7。 2. 在未关闭该 fd 的情况下 fork/exec 容器 PID 1。 3. 通过 runc 的 spe...

CVE-2025-1974

Ingress NGINX 漏洞利用工具 - IngressNightmare 该项目提供了一个针对 Kubernetes 中 Ingress NGINX Controller 的严重 未经身份验证的远程代码执行（RCE） 漏洞的利用工具，统称为 IngressNightmare。 在最初的研究中，Wiz 团队没有提供 PoC 或功能性漏洞利用代码，因此我们决定自行创建并分享给社区。 概述 Ingress NGINX Controller 是 Kubernetes...

docker_lightman_exploit

Docker Lightman 漏洞利用 Docker CVE-2022-37708。 此漏洞利用依赖于 UNIX 文件系统在 Docker 共享文件时设置 UID 和 GID 的方式，这些文件在运行 Docker 的宿主机与被 Docker 容器内运行的客户端之间共享，同时也依赖于进程 ID 所有权的工作原理。 问题简述 Docker 将客户端内共享的文件 ID 直接映射到“宿主机系统”上的一个私有（且受保护的）目录（例如 /var/lib/docker/volumes）。 对此路径的目录遍历已被正确限制，这不是本漏洞的利用点。 这些文件具有在托管于 Docker...

CVE-2024-21626-old-docker-versions

오래된 runc 구성요소의 컨테이너 탈출 취약점 CVE-2024-21626 CVE-2024-21626에 대한 분석 중에 다른 오래된 Docker 구성 요소들이 fd 누출 에 취약하다는 것을 발견했습니다 보안 권고 GHSA-xr7r-f8xq-vfvv에는 언급되지 않은 내용입니다. 자세한 설명은 제 전체 글 여기에서 읽을 수 있습니다. 1. 환경 설정 🔨 A. Ubuntu 18.04.6 LTS Bionic Beaver 버전 다운로드 및 설치 설치 중에 업데이트 시스템 다운로드 상자를 체크하지 마세요. B. 취약한 Docker 버전...

CVE-2022-2602-Kernel-Exploit

CVE-2022-2602-Kernel-Exploit Details https://blog.hacktivesecurity.com/index.php/2022/12/21/cve-2022-2602-dirtycred-file-exploitation-applied-on-an-iouring-uaf/ TL;DR The vulnerability is an Use-After-Free that impacts the registered file descriptor functionality in the iouring subsystem. It's...

fastjson-jsontype-rce-lab

Fastjson @JSONType 원격 JAR/FD 체인 연구소 및 탐지 이 저장소는 이제 두 개의 별도 Fastjson 연구 트랙을 제공합니다: modern-fd/는 권장되는 마커 전용 재구성으로, Spring Boot 3, 일반 임베디드 Tomcat 및 JDK 17에서 Fastjson 1.2.83 단일 본문 원격 JAR/파일 디스크립터 체인을 재현합니다. AutoType을 비활성화한 상태에서 리터럴 고정 DTO 싱크인 JSON.parseObjectbody, BoundEnvelope.class를 사용합니다. 원래 최상위...

cve-2024-21626-runc-1.1.11-escape

CVE-2024-21626 - runc Vasi che perdono Panoramica Campo| Dettaglio ---|--- CVE| CVE-2024-21626 Componente affetto| runc ≤ 1.1.11 Classe di vulnerabilità| Fuga dal contenitore tramite perdita di file descriptor Soprannome| Vasi che perdono Causa principale runc perde un file descriptor interno...

CVE-2024-21626-POC

CVE-2024-21626-POC Istruzioni per l'uso Solo per uso educativo/di ricerca. Qualsiasi azione non correlata a scopi educativi/di ricerca è a proprio rischio. Utilizzo root@kitploit: docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy Nota I...

Wasmtime has a leak in WASIp1 `fd_renumber` implementation

Impact Wasmtime's native implementation of WASIp1 suffers from a leak in the fdrenumber function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of...

CVE-2026-73102 RustDesk Path Traversal via macOS Clipboard File-Paste

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

EUVD-2026-66421

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

CVE-2024-21626-POC

CVE-2024-21626-POC Instruções de uso Apenas para uso educacional/pesquisa; os riscos decorrentes de qualquer comportamento não relacionado a educação/pesquisa são de responsabilidade do usuário. Uso root@kitploit: docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh...

cve-2024-21626

CVE-2024-21626 Panoramica Questo repository contiene esempi di codice per un'app vulnerabile a CVE-2024-21626 e un gadget eBPF per rilevare i tentativi di sfruttamento. Questo repository è stato creato come parte di questo post del blog. Il programma gadget usato per rilevare questa vulnerabilità...

public-passwd

!WARNING Usa questo solo su sistemi di tua proprietà o per cui hai autorizzazione al test. Si consiglia di tenere aperta una shell di root se non potrai riavviare il sistema in caso di fallimento, poiché potresti non essere in grado di cancellare la cache di pagina per /etc/shadow senza root...

ptrace_may_dream

ptracemaydream CVE-2026-46333 Exploit di escalation dei privilegi locale per la condizione di race mm=NULL in ptracemayaccess in pidfdgetfd2. Quando un processo sta morendo e la sua mm è già stata rilasciata, il kernel salta completamente il controllo di accesso ptrace. Mettendo in competizione...

vim: Vim: Stack Buffer Overflow via unbounded socket connections

A flaw was found in Vim. The socket server backend accepts an unbounded number of client connections, causing file descriptors to overflow internal data structures. A local process able to connect to the server socket can exploit this to corrupt stack memory or terminate the Vim server. This can...

BIT-CONSUL-2026-15972 Unauthenticated denial of service via unbounded external gRPC connection acceptance

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

CVE-2026-74487

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...

CVE-2026-74487

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...