Concryptor

Concryptor A multi-threaded AEAD encryption engine built in Rust. Encrypts and decrypts files at gigabyte-per-second throughput using a triple-buffered iouring pipeline, parallel chunk processing via Rayon, and assembly-optimized ciphers via ring. ⚠️ DISCLAIMER: EXPERIMENTAL SOFTWARE ⚠️ This...

CVE-2024-0582

RU GenIoURingExploit is a PoC exploit targeting a specific vulnerability in the Linux kernel CVE-2024-0582. The PoC leverages the iouring mechanism to gain unintended access and potentially escalate privileges by manipulating socket buffers and triggering certain kernel behaviors. Features Utiliz...

CVE-2023-2598

CVE-2023-2598 what's iouring? ​ iouring is a system call interface for Linux. It has supported almost all system call so far, not only read and write initially. It enables an application to initiate system calls that can be performed asynchronously. Submission and Completion Queues At the core of...

io_uring-n-day

CVE-2024-0582 PoC This repository contains a proof of concept for CVE-2024-0582 page-level use after free in iouring used for academic research. It includes a kernel configuration, build and run scripts for a reproducible QEMU environment, and the PoC exploit used in my analysis. Use this code on...

CVE-2024-0582

Introduction This exploit implements a Dirty Cred attack method to gain unauthorized write access to /etc/passwd. Unlike many similar exploits that create numerous pages or aggressively spray file descriptors, this approach takes a more targeted route to corrupt the necessary kernel structures...

CVE-2022-2602-Kernel-Exploit

CVE-2022-2602-Kernel-Exploit Details https://blog.hacktivesecurity.com/index.php/2022/12/21/cve-2022-2602-dirtycred-file-exploitation-applied-on-an-iouring-uaf/ TL;DR The vulnerability is an Use-After-Free that impacts the registered file descriptor functionality in the iouring subsystem. It's...

cve-2024-0582

PoC for CVE-2024-0582 While learning about the iouring interface, I decided to create a PoC for CVE-2024-0582. All of this work is derived directly from the CVE information, the patch and a few other write ups related to io uring -- particularly Chompie's write up of CVE-2021-41073...

Furtex

Furtex Linux向けポストエクスプロイトおよび回避研究ツールキット。iouringとeBPFをベースに構築。liburingやフレームワークは使わず、生のシステムコールのみを使用。 まもなくさらにツールを追加予定。PR歓迎。🇧🇷 Rootkit Researchersに参加 https://discord.gg/66N5ZQppU7 許可された研究およびレッドチームエンゲージメントに限ります。所有していないシステムで実行しないでください。 Furtex/ ├── iouring/ raw iouring ops: file, net, injection, exfil 13...

io_uring_scanner

iouring 스캐너 Rust로 작성된 iouring 기반 네트워크 스캐너입니다. 다음을 참조하세요: Rust로 iouring 기반 네트워크 스캐너 구축하기. 3가지 스캔 모드를 지원합니다: TCP connect SSH 버전 매칭 정규 표현식 매칭 HTTP 헤더 매칭 응답 헤더에 대한 정규 표현식 매칭 소스에서 빌드 rustup의 nightly 툴체인이 포함된 Rust 빌드 환경이 필요합니다. root@kitploit: cargo build --release binary is built as...

RingReaper

RingReaper RingReaper 는 EDR 솔루션에 탐지될 가능성을 최소화하면서 은밀하게 작동해야 하는 사람들을 위해 설계된 Linux용 간단한 사후 침투post-exploitation 에이전트입니다. 이 프로젝트의 아이디어는 Linux 커널의 새로운 비동기 I/O 인터페이스인 iouring 을 활용하여 대부분의 EDR이 모니터링하거나 후킹하는 경향이 있는 전통적인 시스템 호출을 피하는 것이었습니다. 실제로 RingReaper는 read, write, recv, send, connect 등의 호출을 비동기 I/O...

CVE-2022-29968

CVE-2022-29968 Эксплойт Proof-of-concept для CVE-2022-29968 неинициализированная память в ядре Linux, а именно в системе iouring. Сбой был обнаружен с помощью Syzkaller. Проанализировали сбой Джозеф Равичандран и Майкл Ван. Эксплойт написан Джозефом Равичандраном. Мы нашли и сообщили об этой ошиб...

CVE-2022-29582-Exploit

CVE-2022-29582 This repository contains exploit code for CVE-2022-29582, a Local Privilege Escalation in iouring of the Linux kernel. Default configurations are affected and no special privileges should be needed. You can find the writeup at...

CVE-2026-81009

A flaw was found in the Linux kernel. The iouring/query interface, specifically within the iohandlequeryentry function, does not properly cap the user-provided size when zeroing memory. A local attacker can exploit this by sending a specially crafted query that requests an excessively large amoun...

CVE-2026-81010

A flaw was found in the Linux kernel's iouring/waitid component. The iowaitidcb function, when running from a kernel worker, fails to properly acknowledge task work cancellation. This oversight causes the dowait function to execute within an incorrect task context, which is critical as waitid...

CVE-2024-0582-dataonly

CVE-2024-0582 CVE-2024-0582를 기반으로 한 데이터 전용 공격 설명 이 익스플로잇은 이 블로그 게시물의 전략을 따르지만, 파일을 열기 위해 자식 프로세스를 사용하지 않았습니다. GitHub에서 이 분석 글의 전략을 따르는 익스플로잇을 발견했습니다. 소켓 기반 제어 흐름 하이재킹으로 익스플로잇을 재현한 후, 아직 오픈소스화되지 않은 것으로 보이는 데이터 전용 공격으로 익스플로잇을 구현하려고 시도했습니다. Claude 사용해보기 위의 두 분석 글과...

CVE-2026-81010

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: honor taskwork cancellation iowaitidcb may run through the fallback taskwork path when taskworkadd can no longer queue work to the originating task. The fallback runs from a kworker and iouring marks such task wor...

CVE-2026-81009

In the Linux kernel, the following vulnerability has been resolved: iouring/query: cap user size passed to copystructtouser iohandlequeryentry clamps hdr.size for the inbound copyfromuser but keeps the original user value as usize. copystructtouser uses that usize and, when it is larger than the...

CVE-2026-81009

CVE-2026-81009 affects the Linux kernel in the io_uring/query subsystem. The function io_handle_query_entry() clamps hdr.size for the inbound copy_from_user() but retains the original user-supplied value as usize. When passed to copy_struct_to_user(), an oversized usize triggers clear_user() on t...

CVE-2026-81010

CVE-2026-81010 affects the Linux kernel's io_uring/waitid component. The function io_waitid_cb() fails to honor the tw.cancel flag when executed via the fallback task_work path from a kworker, causing __do_wait() to run in the wrong task context. Because waitid is task-context dependent, child lo...

EUVD-2026-76332

In the Linux kernel, the following vulnerability has been resolved: iouring/query: cap user size passed to copystructtouser iohandlequeryentry clamps hdr.size for the inbound copyfromuser but keeps the original user value as usize. copystructtouser uses that usize and, when it is larger than the...