CVE_2026_40369

CVE202640369 Exploit poc ed exp per CVE202640369, legati alla mia analisi, usano cmake. Il codice di debug, i file poc ed exp per la riproduzione di CVE202640369 sono scritti usando cmake. Come al solito, basta usare i normali comandi cmake per completare la compilazione. Articoli di analisi:...

CVE-2023-2598

CVE-2023-2598 Referenzen: https://anatomic.rip/cve-2023-2598/ https://github.com/ysanatomic/iouringLPE-CVE-2023-2598 https://bsauce.github.io/2024/07/30/CVE-2023-2598/ Erstellen: root@kitploit: apt install -y liburing-dev gcc CVE-2023-2598.c -o CVE-2023-2598 -luring PoC: root@kitploit:...

hbp-attack-demo

fork da https://github.com/veritas501/hbpattackdemo hbpattack demo Riferimento al blog P0: https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html Ho buttato giù un modulo vuln, fingendo di avere una primitiva di scrittura in un indirizzo...

CVE-2026-43499-S25U

CVE-2026-43499 PoC per Galaxy S25 Ultra Proof of concept specifico per il dispositivo per CVE-2026-43499 sul Samsung Galaxy S25 Ultra coreano. Target supportato root@kitploit: Model: SM-S938N Codename: pa3q Android: 16 / API 36 Build: S938NKSUACZF1 Display ID: BP4A.251205.006.S938NKSUACZF1...

prefetch-tool

Strumento Prefetch KASLR per Windows Uno strumento proof-of-concept per bypassare KASLR ASLR del kernel su Windows 11. Ispirato da EntryBleed per Linux. Questo strumento è stato sviluppato come parte di un exploit che ha come target Windows 11 24H2. Non sono affatto un esperto di canali laterali,...

cve-2026-43499-m3q-azf1

GhostLock-SELinux-Park — SM-S948U1 / AZF1 m3q Forschungsschnappschuss eines funktionierenden SELinux-only-Parks für das Samsung Galaxy S26 Ultra SM-S948U1, Codename m3q auf Firmware S948U1UES3AZF1 GKI 6.12.30-android16-5. Dieses Paket ist kein vollständiger Root. Es schaltet SELinux auf Permissiv...

CVE-2025-50168-pwn2own-berlin-2025

Author: D4m0n CVE-2025-50168 Dies ist ein Exploit, der für die Pwn2Own Berlin 2025 – LPE-Kategorie eingereicht wurde. Die Schwachstelle tritt in Win32kbase!DirectComposition auf; weitere Einzelheiten finden sich im Blogbeitrag. Danksagungen kASLR-Bypass-Technik: prefetch-tool von carrotc4k3...

s26-m1q-ghostlock-selinux

S26 SM-S942U1 / m1q GhostLock CVE-2026-43499 — SELinux Permissive erreichen Forschung zur Privilegieneskalation mittels CVE-2026-43499 GhostLock für das Samsung Galaxy S26 SM-S942U1, Codename m1q, SoC SM8850 Snapdragon 8 Elite Gen2, Kernel 6.12.30-android16-5, Android 16. Statusübersicht Ziel|...

UBUNTU-CVE-2026-72013

In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machinekexecprepare A NULL pointer dereference issue is noticed in riscv's machinekexecprepare, where image-segmenti.buf might be NULL and copied unchecked. The NULL buf comes from...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 vivo PD2425 Exploit Adaptation Project A porti...

Exploit for CVE-2026-50416

CVE-2026-50416: a kernel pointer on every desktop, readable fr...

CVE-2026-13199

CVE-2026-13199 affects Raspberry Pi 5 and Compute Module 5 EEPROM firmware. The issue is that the EEPROM produced non-random KASLR and RNG seed values, resulting in consistent kernel addresses across boots and devices. This may lower entropy and potentially ease exploitation of other vulnerabilit...

UBUNTU-CVE-2026-52937

In the Linux kernel, the following vulnerability has been resolved: tap: fix stack info leak in tapioctl SIOCGIFHWADDR In the SIOCGIFHWADDR path, tapioctl copies 16 bytes of an uninitialised on-stack struct sockaddrstorage to userspace via ifrhwaddr, but netifgetmacaddress only writes safamily an...

CVE-2026-52937

CVE-2026-52937 concerns the Linux kernel where the tap_ioctl() path handling SIOCGIFHWADDR leaks kernel stack contents by copying 16 bytes of an uninitialised sockaddr_storage to userspace. Specifically, netif_get_mac_address() writes only sa_family and dev->addr_len (6 bytes), leaving sa_data...

EUVD-2026-38707

In the Linux kernel, the following vulnerability has been resolved: tap: fix stack info leak in tapioctl SIOCGIFHWADDR In the SIOCGIFHWADDR path, tapioctl copies 16 bytes of an uninitialised on-stack struct sockaddrstorage to userspace via ifrhwaddr, but netifgetmacaddress only writes safamily an...

📄 Qualcomm CVP Kernel Pointer Leak

The Qualcomm CVP driver exposes kernel pointers to userland by returning a hashed session ID derived from a kernel pointer using hash32ptr. This function is not a cryptographic hash but a reversible fold that XORs the upper and lower 32 bits of the pointer. Due to predictable ARM64 kernel virtual...

CVE-2026-23763

VB-Audio Matrix and Matrix Coconut versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively, contain a local privilege escalation vulnerability in the VBMatrix VAIO virtual audio driver vbmatrixvaio64win10.sys. The driver allocates a 128-byte non-paged pool buffer and, upon receiving IOCT...

CVE-2026-23763

VB-Audio Matrix and Matrix Coconut versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively, contain a local privilege escalation vulnerability in the VBMatrix VAIO virtual audio driver vbmatrixvaio64win10.sys. The driver allocates a 128-byte non-paged pool buffer and, upon receiving IOCT...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000915)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000915 advisory. The acpinsevaluate function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003710)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003710 advisory. An issue was discovered in the fdlockedioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to...