360WFP_Exploit

360WFPExploit 360 Security WFP ドライバー（360netmonx64wfp.sys） のインターフェースが悪用される可能性を示す概念実証（PoC）です。呼び出し元の認証がない IOCTL インターフェースがサードパーティープログラムによって悪用されるリスクを検証することを目的としています。 このプロジェクトはセキュリティ研究と脆弱性分析の目的のみで利用されることを意図しています。いかなる違法目的でも使用してはなりません。 プロジェクト概要 360 Security のネットワーク監視ドライバー 360netmonx64wfp.sys...

CVE-2022-22077

✅ CVE-2022-22077 利用框架 RTCore64.sys： 本文档全面概述了 CVE-2022-22077 利用框架，这是一个针对 RTCore64.sys 驱动程序漏洞的高级 BYOVD（自带易受攻击驱动程序）攻击工具包。该框架展示了用于教育和安全研究目的的高级 Windows 内核利用技术。 涵盖内容包括漏洞的技术基础、框架架构以及与更广泛的 LazyOwn RedTeam 工具集的集成。有关详细的漏洞分析，请参阅漏洞分析。有关各个组件的具体实现细节，请参阅利用框架。 🚨 CVE-2022-22077 — MSI Center / Dragon Center — 通过...

KillChain

KillChain ?? 免责声明： 本项目严格用于教育和安全研究目的 。作者不对因使用本工具而导致的任何滥用、损害或非法活动负责。请仅在隔离的实验环境中并在获得明确许可的情况下使用。 概述 KillChain 是一款用户态工具，利用存在漏洞的内核驱动程序（ProcessMonitorDriver.sys，CVE-2026-0828）从用户空间终止受保护进程。它通过自定义 IOCTL 接口与内核通信，绕过标准进程保护机制。 该工具将驱动程序二进制文件直接嵌入可执行文件中，运行时将其提取到临时位置，注册为内核服务，通过 NtLoadDriver 加载，并通过 DeviceIoControl...

Astra Linux – Vulnerability in Linux

A out-of-bounds memory write flaw was discovered in the Linux kernel’s joystick devices subsystem in versions prior to 5.9-rc1. This flaw allows a local user to crash the system or potentially escalate their privileges on the system. The greatest threat posed by this vulnerability is related to...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ethtool: Fixed an issue where the uninitialized number of lanes was used. It is not possible to set the number of lanes when adjusting link modes using the legacy IOCTL ethtool interface. Since the structure struct...

CVE-2025-51619

A vulnerability in the Thesycon DPC Latency Checker driver dpc.sys thru 1.4.0 allows local unprivileged users to cause a denial-of-service BSOD condition on Windows systems. The driver exposes an IOCTL interface 0x81772008 that accepts user-controlled input without validating pointers before...

PT-2026-89122

A vulnerability in the Thesycon DPC Latency Checker driver dpc.sys thru 1.4.0 allows local unprivileged users to cause a denial-of-service BSOD condition on Windows systems. The driver exposes an IOCTL interface 0x81772008 that accepts user-controlled input without validating pointers before...

CVE-2025-51619

A vulnerability in the Thesycon DPC Latency Checker driver dpc.sys thru 1.4.0 allows local unprivileged users to cause a denial-of-service BSOD condition on Windows systems. The driver exposes an IOCTL interface 0x81772008 that accepts user-controlled input without validating pointers before...

EUVD-2025-210885

A vulnerability in the Thesycon DPC Latency Checker driver dpc.sys thru 1.4.0 allows local unprivileged users to cause a denial-of-service BSOD condition on Windows systems. The driver exposes an IOCTL interface 0x81772008 that accepts user-controlled input without validating pointers before...

CVE-2025-51619

A vulnerability in the Thesycon DPC Latency Checker driver dpc.sys thru 1.4.0 allows local unprivileged users to cause a denial-of-service BSOD condition on Windows systems. The driver exposes an IOCTL interface 0x81772008 that accepts user-controlled input without validating pointers before...

UBUNTU-CVE-2026-74466

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Close speculative mem read possibility The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions custom...

CVE-2026-64529

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device qatadfctl with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public...

CVE-2026-64529 crypto: qat - remove unused character device and IOCTLs

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device qatadfctl with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public...

PT-2026-64529

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto ccp component where the system improperly initializes SNP for the ioctlSNP VLEK LOAD function. A userspace process could potentially trigger this code path...

CVE-2026-0125

In multiple functions of vpuioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-46151

In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix heap leak in IEEE 1284 device ID via short response usblpctrlmsg collapses the usbcontrolmsg return value to 0/-errno, discarding the actual number of bytes transferred. A broken printer can complete the GETDEVICE...

EUVD-2026-28603

In the Linux kernel, the following vulnerability has been resolved: spi: spidev: fix lock inversion between spilock and buflock The spidev driver previously used two mutexes, spilock and buflock, but acquired them in different orders depending on the code path: write/read: buflock - spilock ioctl...

CVE-2025-70795

STProcessMonitor 11.11.4.0, part of the Safetica Application suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabli...

Safetica Application 安全漏洞

Safetica Application is a corporate data leakage prevention and endpoint behavior control software developed by Safetica, Inc. Version 11.11.4.0 of Safetica Application contains a security vulnerability. This vulnerability stems from insufficient validation during the call to the driver’s IOCTL...

CVE-2026-22163: Missing Synchronization

Requires malware code to misuse the DDK kernel module IOCTL interface. Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages. The product utilises a shared resource in a concurrent manner but does not attempt t...