CVE-2018-4878

CVE-2018-4878 POC CVE-2018-4878 首次被证实遭 TEMP.Reaper 在野利用。 本仓库包含我们根据所分析的恶意软件开发出的 POC，该 POC 已知可通过利用释放后使用（Use-After-Free）漏洞，攻击 32 位版本的 Flash 27。 成功利用该漏洞后，攻击者将获得一个能够修改进程内存的 ByteArray 对象。 关于该漏洞的完整剖析，可在此处查看。...

CVE-2026-98020

A flaw was found in the Linux kernel's pdscore driver. This vulnerability can lead to a denial of service DoS through a system crash. A local user with administrative privileges could trigger this issue by initiating a device reset while a firmware flash update is in progress, causing the driver ...

CVE-2026-97534

A flaw was found in the Linux kernel's Flash-Friendly File System F2FS. When segment ranges are truncated, the file system fails to properly adjust the free section counter for sections that were already marked free, leading to an overestimation of available storage during background garbage...

spidump

spidump — captura y reconstrucción de trazas SPI/QSPI spidump analiza capturas de analizador lógico de un dispositivo que lee su flash NOR SPI/QSPI durante el arranque y reconstruye la imagen de la flash a partir del tráfico de lectura — sin necesidad de leer directamente el chip. El conjunto de...

CVE-2025-47827

CVE-2025-47827 针对 CVE-2025-47827 的概念验证与漏洞报告。 目录 描述 披露 影响 检测 缓解措施 二进制文件 概念验证 资源 描述 在 v11 之前的 IGEL OS 中，Secure Boot 可被绕过，原因是 igel-flash-driver 模块未正确验证密码学签名。最终，一个精心构造的根文件系统可以从未经验证的 SquashFS 镜像中挂载。 IGEL OS 10 中 Linux 内核模块 igel-flash-driver 对密码学签名验证不当，允许恶意行为者通过启动由 Microsoft 第三方 UEFI CA 签名的 shim 来绕过...

SpiMitm

+OPTIONS: ^: SpiMitm - PoC de ataque MitM de lectura de flash SPI para antiforensia de firmware Este PoC está enfocado en https://up-board.org/upsquared/specifications/UP Squared. Cómo usar Sigue el proceso de compilación de Alan Sguigna explicado...

Exploit-Writeups

This is a collection of exploit writeups that I've authored: PS3 lv0ldr SPI MITM...

flash-exploit-defense-system

flash-exploit-defense-system Sistema de defensa integral multicapa contra exploits CVE de Adobe Flash CVE-2012-0754, CVE-2015-xxxx, CVE-2016-xxxx, CVE-2018-xxxx con protección a nivel de navegador, móvil, servidor y sistema...

CVE-2025-57428

⚠️ 本仓库仅作为 CVE-2025-57428 的参考维护。 其他公告和更新请参考：security-advisories。 CVE-2025-57428 - 默认启用的 Telnet 调试接口允许低层级闪存/寄存器访问 受影响产品 厂商/品牌：Each Italy 设备：无线迷你路由器 WIRELESS-N 300M 固件版本：v28K.MiniRouter.20190211 摘要 该设备暴露了一个 Telnet 调试接口（默认在端口 23 上启用），并接受管理员凭据（默认 admin/admin）。认证后，Shell 提供了对低级命令的直接访问（特别是 spi 和...

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383

Divulgación de información sensible a través del firmware SPI flash del router Hathway CVE-2024-46383 Descripción de la vulnerabilidad: Durante la evaluación de seguridad del firmware del router, se observó que la información sensible sobre los dispositivos conectados al router, como teléfonos...

CVE-2015-0311

Reupload of an old Linux/Firefox port of an exploit for CVE-2015-0311 Use-after-free in Adobe Flash Player I created for educational purposes. 针对CVE-2015-0311的旧版Linux/Firefox端口利用（Adobe Flash Player中的释放后使用漏洞）的重新上传，我出于教育目的创建了它。...

CVE-2025-51643

CVE-2025-51643：未受保护的 SPI Flash 使 Meitrack T366G-L 固件可被提取 描述 Meitrack T366G-L GPS 追踪器设备包含一个 SPI 闪存芯片（Winbond 25Q64JVSIQ），该芯片无需身份验证或防篡改保护即可访问。具有物理访问权限的攻击者可以连接标准 SPI 编程器，并使用 flashrom 提取设备固件。这会导致敏感配置数据（如 APN 凭据、后端服务器信息和网络参数）以明文形式暴露。同一访问路径还使固件修改和重新刷写成为可能。 受影响产品 厂商： Meitrack Group 产品： Meitrack T366G-L...

AZL-104229 CVE-2026-98020 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

DEBIAN-CVE-2026-98020

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

CVE-2026-98020

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

UBUNTU-CVE-2026-98020

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

EUVD-2026-86673

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

CVE-2026-98020

A vulnerability exists in the Linux kernel 's pds_core component where a race condition can occur during a BAR unmap on reset. Specifically, the error path in pdsc_map_bars() within pdsc_reset_prepare() and pdsc_reset_done() can clear or iounmap cmd_regs without holding the devcmd_lock. Additiona...

CVE-2026-98020

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

Linux Distros Unpatched Vulnerability : CVE-2026-98020

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and...