59308 matches found
EUVD-2026-81839
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...
CVE-2026-90246
An integer overflow in the Linux kernel's AppArmor subsystem, specifically in verify_tags(), allows a crafted policy blob to bypass a bounds check. The check computes i + cnt using u32 arithmetic , so a count near U32_MAX wraps the sum to zero, letting the inner loop read past the end of the allo...
CVE-2026-90200
CVE-2026-90200 affects the Linux kernel NTFS3 filesystem driver (fs/ntfs3). In ntfs_init_from_boot(), the MFT cluster numbers (mlcn, mlcn2) read from the boot sector are validated via a u64 multiplication against the volume size. A sufficiently large value (e.g., near 2^62) causes the multiplicat...
EUVD-2026-81793
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...
CVE-2026-90196
CVE-2026-90196 affects the Linux kernel 's ASoC SOF (Sound Open Firmware) subsystem. SOF treats topology mixer min and max values as non-negative indices into its volume table but stores them in signed fields and allocates max + 1 entries through an int argument . An inverted range is invalid, an...
EUVD-2026-81789
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...
gosentry
gosentry gosentry es un fork centrado en la seguridad de la cadena de herramientas de Go, que integra numerosas funciones para campañas de fuzzing de vanguardia en bases de código Go. Si antes usabas go test -fuzz, deberías usar gosentry como reemplazo. Incluye varias mejoras de fuzzing y...
CVE-2026-90141
CVE-2026-90141 affects the Linux kernel 's IPVS (IP Virtual Server) FTP helper. The function ip_vs_ftp_get_addrport() accumulates decimal digits into a __u16 and an unsigned char without overflow checks. A crafted FTP PASV/EPSV response containing an over-long port or address octet causes the val...
EUVD-2026-81734
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ipvsftpgetaddrport accumulates decimal digits into a u16 hport and into unsigned char p without checking for overflow. A crafted FTP PASV/EPSV response with an over-lo...
CVE-2026-90109
CVE-2026-90109 is a 32-bit integer overflow in the Linux kernel network scheduling subsystem, affecting the gred , bfifo , and plug qdisc enqueue paths. The backlog and packet-length sum is computed in u32 , wrapping at 2³² (4 GiB) . Once the true backlog exceeds this threshold, the wrapped sum a...
CVE-2026-90076
CVE-2026-90076 affects the Linux kernel 's net/sched FQ (Fair Queue) qdisc. In fq_init(), the quantum and initial_quantum values are computed from psched_mtu() without overflow protection. A network device with an extremely large MTU (e.g., a dummy device accepting MTU 2147483634) causes the 32-b...
EUVD-2026-81936
In the Linux kernel, the following vulnerability has been resolved: net/sched: fqcodel: clamp default quantum and mtu fqcodelinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return 0x80000000...
EUVD-2026-81934
In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhfchange to avoid overflow hhfinit sets q-quantum = pschedmtuqdiscdevsch with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes weight...
Pixel_GPU_Exploit
Mali GPU Kernel LPE Este artículo proporciona un análisis en profundidad de dos vulnerabilidades del kernel en la GPU Mali, alcanzables desde el sandbox de aplicaciones predeterminado, que identifiqué y reporté de forma independiente a Google. Incluye un exploit del kernel que logra capacidades...
Integer-Overflow-test
Este repositorio no tiene un README...
batchOverflow
batchOverflow A fix for the batchOverflow bug found by the PeckShield team. a fix The original contract only did a check to ensure the sender has enough whatever to pay the total amount input value x number of addresses. If an overflow ocurred this amount can be zero, which would allow the test o...
kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
A flaw was found in the Linux kernel's qrtr network component. On 32-bit systems, a 32-bit integer overflow can occur in the qrtrendpointpost function when processing an incoming packet. This overflow can bypass a size validation check, leading to an out-of-bounds write and causing the kernel to...
CVE-2020-0796
CVE-2020-0796 概述： SMBv3从Windows 10/Server版本1903开始添加的压缩功能存在整数溢出漏洞，微软于2020年3月12日确认。攻击者可以利用该漏洞实现本地权限提升（LPE）和远程代码执行（RCE）。此处仅讨论LPE漏洞。 受影响版本 ： Windows 10 Version 1903 for 32-bit Systems Windows 10 Version 1903 for x64-based Systems Windows 10 Version 1903 for ARM64-based Systems Windows Server, version...
CVE-2020-1206
在SMBGhost漏洞（CVE-2020-0796）中，我提到了一种通过利用整数溢出漏洞修改Alloc.Userbuffer指针指向我们想要的地址并写入任意数据的write-what-where原语技术。类似于SMBGhost，此漏洞也存在于srv2.sys中的Srv2DecompressData函数中。让我们再次回顾由Zecops简化的与SMBGhost漏洞（CVE-2020-0796）相关的Srv2DecompressData函数。 c typedef struct COMPRESSIONTRANSFORMHEADER ULONG ProtocolId; ULONG...