Linux Kernel (PonyOS 3.0) - TTY 'ioctl()' Local Privilege Escalation

/ Exploit Title: PonyOS include include int main struct winsize ws; printf"+ PonyOS = 3.0 ioctl local root exploit\n"; memcpy&ws,"\x90\x90\x90\x90\x8b\x45\x08\x89",8; ioctl0, TIOCSWINSZ, &ws; ioctl0, TIOCGWINSZ, void 0x0010f101; printf"- patched syssetuid\n"; asm"movl $0x18,%eax"; asm"xorl...

Windows - CNG.SYS Kernel Security Feature Bypass PoC (MS15-052)

Exploit for windows platform in category local exploits // Source: http://www.binvul.com/viewthread.php?tid=508 // Source: https://twitter.com/NTarakanov/status/598370525132423168 include include include pragma commentlib, "ntdll.lib" int mainint argc, CHAR argv typedef NTSTATUS stdcall...

CVE-2015-4036

Array index error in the tcmvhostmaketpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service memory corruption or possibly have unspecified other impact via a crafted VHOSTSCSISETENDPOINT ioctl call. NOTE: the affected function w...

kernel security and bug fix update

2.6.32-504.16.2 - infiniband core: Prevent integer overflow in ibumemget address arithmetic Doug Ledford 1181173 1179327 CVE-2014-8159 2.6.32-504.16.1 - fs gfs2: Move gfs2filesplicewrite outside of ifdef Robert S Peterson 1198329 1193559 - security keys: close race between key lookup and freeing...

Memory corruption

The mmfslinux kernel module in IBM General Parallel File System GPFS 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to cause a denial of service memory corruption via unspecified character-device ioctl calls...

CVE-2015-0199: Undefined Security Weakness

The mmfslinux kernel module in IBM General Parallel File System GPFS 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to cause a denial of service memory corruption via unspecified character-device ioctl calls...

PT-2015-4522

Name of the Vulnerable Software and Affected Versions IBM General Parallel File System GPFS versions 3.4 before 3.4.0.32 IBM General Parallel File System GPFS versions 3.5 before 3.5.0.24 IBM General Parallel File System GPFS versions 4.1 before 4.1.0.7 Description The issue allows local users to...

Intel Network Adapter Diagnostic Driver - IOCTL Handling Vulnerability

Exploit for windows platform in category dos / poc / Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Vendor: Intel Product webpage: http://www.intel.com Affected products: Network Adapter Driver for Windows XP Network Adapter Driver for Windows 7 Network Adapter Driver for...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3012)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3012 advisory. - ttusb-dec: buffer overflow in ioctl Dan Carpenter Orabug: 20673373 CVE-2014-8884 - mm: Fix NULL pointer dereference in madviseMADVWILLNEED suppor...

Intel Network Adapter Diagnostic Driver IOCTL DoS

/ Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Vendor: Intel Product webpage: http://www.intel.com Affected products: Network Adapter Driver for Windows XP Network Adapter Driver for Windows 7 Network Adapter Driver for Windows 8 Network Adapter Driver for Windows 2008/R2...

Intel Network Adapter Diagnostic Driver - IOCTL Handling

Intel Network Adapter Diagnostic Driver - IOCTL Handling / Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Vendor: Intel Product webpage: http://www.intel.com Affected products: Network Adapter Driver for Windows XP Network Adapter Driver for Windows 7 Network Adapter Driver...

SoftSphere DefenseWall Personal Firewall Elevation of Privilege Vulnerability

SoftSphere DefenseWall Personal Firewall is Internet security software from the Czech company Softsphere. SoftSphere DefenseWall Personal Firewall 3.24 suffers from a privilege-raising vulnerability that allows a local user to write data to an arbitrary storage unit with privileges gained by...

CVE-2015-1515: Undefined Security Weakness

The dwall.sys driver in SoftSphere DefenseWall Personal Firewall 3.24 allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted 0x00222000, 0x00222004, 0x00222008, 0x0022200c, or 0x00222010 IOCTL call...

PT-2015-5338

Name of the Vulnerable Software and Affected Versions SoftSphere DefenseWall Personal Firewall version 3.24 Description The issue allows local users to gain privileges by writing data to arbitrary memory locations via a crafted IOCTL call, specifically 0x00222000, 0x00222004, 0x00222008,...

PT-2016-3560

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x and 4.x Description The issue is related to the WLAN driver for the Linux kernel, which does not properly verify authorization for certain private SET IOCTL calls. This allows attackers to potentially gain privileges ...

Multiple Trend Micro Products tmeext.sys Driver Elevation of Privilege Vulnerabilities

Trend Micro Antivirus Plus, Internet Security and Maximum Security are all antivirus programs from Trend Micro. A security vulnerability exists in the tmeext.sys driver prior to version 2.0.0.1015. A local attacker can exploit this vulnerability by writing to an arbitrary memory location via a...

CVE-2015-1305

McAfee Data Loss Prevention Endpoint DLPe before 9.3.400 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 1 0x00224014 or 2 0x0022c018 IOCTL call...

CVE-2014-9643

K7Sentry.sys in K7 Computing Ultimate Security, Anti-Virus Plus, and Total Security before 14.2.0.253 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x95002570, 0x95002574, 0x95002580, 0x950025a8, 0x950025ac, or 0x950025c8 IOCTL call...

CVE-2014-9642

bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before 15.0.288 allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted 0x0022405c IOCTL call...

Memory corruption

bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before 15.0.288 allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted 0x0022405c IOCTL call...