EtwLeakKernel

EtwLeakKernel 이 저장소는 ETW를 사용하여 커널 메모리 주소를 유출하는 프로그램의 PoC를 포함합니다. 이는 소비자를 생성하고거의 모든 공급자가 커널 주소를 유출하므로 거의 모든 공급자에 대해 가능 스택 추적을 요청함으로써 작동합니다. 스택 추적을 받으면 이를 파싱하여 커널 메모리 주소를 추출합니다. Microsoft는 관리자에서 커널로의 경계를 보안 경계로 간주하지 않기 때문에, 이 상황은 당분간 변경되지 않을 것입니다. 일부 익스플로잇 시나리오에서 유용할 수 있습니다예: ETW 공급자가 커널 기본 주소에서 특정...

CVE-2024-26160

CVE-2024-26160 cldflt.sys 정보 공개 취약점 CVE-2024-26160 에 대한 간단한 분석 글입니다. 이 취약점은 2월 패치KB5034765 , Windows 11 22H2, Windows 11 23H2에서 발견할 수 있으며, 3월 패치KB5035853에서 수정되었습니다. 분석 취약점은 CldiPortProcessGetRangeInfo 함수에 있으며, 사용자 애플리케이션에서 전달된 버퍼 크기를 확인하지 않습니다. 크기는 사용자가 제어할 수 있으므로, 반환된 정보를 복사하는 memmove가 크기가 올바르게...

CVE-2025-24990_POC

Windows Agere Modem ドライバー（ltmdm64.sys）。このドライバーは非常に古く、私のテストマシンではデフォルトで読み込まれないため、BYOVDシナリオで悪用します。興味深いことに、私の調査によると、このドライバーはWindows 7に存在し、少なくとも1つのバグがあります。こちら 当時、MSRCは何の対応も取りませんでした 🤡 脆弱性...

CVE-2023-26083

CVE-2023-26083 – 타임라인 스트림을 통한 Mali GPU 커널 주소 누출 이 저장소는 CVE-2023-26083 에 대한 개념 증명PoC 익스플로잇을 포함하고 있습니다. 이 취약점은 Mali GPU 드라이버Arm Mali GPU 커널 드라이버에 존재하며, 권한이 없는 사용자가 타임라인 스트림/dev/mali0을 통해 커널 포인터와 민감한 내부 정보를 누출할 수 있게 합니다. 취약점 개요 Mali GPU 드라이버는 프로파일링 및 디버깅을 위한 '타임라인 스트림'tlstream 기능을 제공합니다. 이 스트림은 원시 커...

CVE-2026-43499-OnePlus15

CVE-2026-43499 — OnePlus 15 LPE 교육용 PoC 경고: 이 저장소는 교육 및 연구 목적으로만 제공됩니다. 사전 빌드된 바이너리나 릴리스는 배포되지 않습니다. 모든 것을 소스에서 직접 빌드해야 합니다. OnePlus 15용 Android 16 로컬 권한 상승. x-spy/CVE-2026-43499-popsicle의 포크이며, kallsyms 정렬 수정 및 검증된 OnePlus 15 프로필이 포함되어 있습니다. 프로필 프로필에는 동일한 펌웨어를 실행하는 루팅된 장치에서 확인해야 하는 두 개의 물리적 주소가...

CVE-2023-2598

CVE-2023-2598 참조: https://anatomic.rip/cve-2023-2598/ https://github.com/ysanatomic/iouringLPE-CVE-2023-2598 https://bsauce.github.io/2024/07/30/CVE-2023-2598/ 빌드: apt install -y liburing-dev gcc CVE-2023-2598.c -o CVE-2023-2598 -luring PoC: user1@syzkaller:$ uname -a Linux syzkaller 6.3.1 6 SMP...

SUSE CVE-2026-89984

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

CVE-2026-90220

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90220 ALSA: seq: Don't leak the extension cell pointer in the bounce payload

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-93074: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

AZL-101672 CVE-2026-89984 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

EUVD-2026-80584

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

Linux Distros Unpatched Vulnerability : CVE-2026-89984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel...

CVE-2026-89984: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sched/taskstack: fixed the objectisonstack function for KASAN-tagged pointers When CONFIGKASANSWTAGS and CONFIGKASANSTACK are enabled, the objectisonstack function may produce incorrect results due to the presence of tags in the...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: dm raid: fixed the KASAN warning in raid5adddisks. There is a KASAN warning in raid5adddisk when running the LVM testsuite. The warning occurs during the test lvconvert-raid-reshape-lineartoraid6-single-type.sh. We fixed this...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: BPF: Use VMMAP instead of VMALLOC for the ringbuf area. After the commit 2fd3fb0be1d1 “kasan, vmalloc: unpoison VMALLOC pages after mapping”, non-VMALLOC mappings will be marked as accessible in getvmareanode when KASAN is enable...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mm: krealloc: Fixed an MTE false alarm in dokrealloc. This patch addresses an issue introduced by commit 1a83a716ec233, which caused MTE Memory Tagging Extension to falsely report a slab-out-of-bounds error. The problem occurs wh...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Allocate sufficient space for GMU registers In commit 142639a52a01 “drm/msm/a6xx: fix crashstate capture for A650”, we changed a6xxgetgmuregisters to read 3 sets of registers. Unfortunately, we did not change the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Disabling KASAN during applyalternatives Fei has reported that KASAN is triggered during applyalternatives on a 5-level paging machine: BUG: KASAN: Out-of-bounds access in rcuiswatching Reading of a 4-byte value...