salt

欢迎使用 salt ，一个用于逆向和学习内核堆内存管理的工具。它可用于开发漏洞利用、调试自己的内核代码，更重要的是，用于操作内核堆分配并学习其内部机制。 该工具有助于跟踪现代 Linux 内核中 SLUB 分配器的分配情况和当前状态。 它作为 gdb 插件编写，允许您跟踪 和记录 内存分配，并按进程名称或缓存过滤 。该工具还可以转储活动缓存列表并打印相关信息。 该仓库还包含一个 游乐场 可加载内核模块，可以随心所欲地触发分配和释放，既可作为调试工具，也可作为学习工具，帮助更好地理解分配器的工作原理。 有关 SLUB 分配器内部机制、如何开始、插件的详细文档 以及 游乐场模块说明...

CVE-2026-64705

CVE-2026-64705 — HFS xattr kernel heap overflow macOS Root-cause analysis and proof-of-concept for CVE-2026-64705, a buffer overflow in the HFS kernel extension fixed in macOS Sonoma 14.8.7 HT127117: HFS — Impact: An app may be able to cause unexpected system termination or write kernel memory. A...

CVE-2019-6207

CVE-2019-6207 getdirentriesattr kernel heap inofo leak 该漏洞可在沙盒中触发，影响 macOS=10.14.4 && ios 12.2 我将很快更新关于此漏洞的更多细节。...

ctl_ctloutput-leak

ctlctloutput-leak macOS High Sierra 10.13 中的 ctlctloutput 函数忽略了 sooptcopyin 调用的返回值，这打开了一个竞态窗口，可将未初始化的内核堆数据泄漏到用户空间。ctlctloutput-leak 是一个概念验证漏洞利用，试图触发此信息泄漏。利用需要 root 权限。 已确认该漏洞利用在 macOS High Sierra 10.13.1 Beta 17B25c 和 iOS 10.1.1 14B100（通过 machportal）上有效。 漏洞：CVE-2017-13868 以下是 macOS High Sierra...

CVE_2025_24257----NOT-MINE

🔧 CVE202524257----NOT-MINE - 安全运行Windows PoC 🧾 概述 CVE202524257----NOT-MINE 是一个Windows概念验证程序，展示了IOGPUFamily中的一个内核内存错误。它基于一个bitmapmask下溢问题，可能导致内核堆越界写入。该项目是与该问题相关的首个公开PoC。 本仓库面向那些希望下载该软件包、在Windows上打开并尽可能少配置地运行示例的用户。本README的目标是让非技术用户也能轻松完成操作。 📥 下载 使用此链接访问项目页面并下载文件： 前往下载页面...

node-cve-2018-4407

node-cve-2018-4407 针对 CVE-2018-4407 的 Node.js PoC 利用代码 作者：Sam Decrock 该脚本基于 Zuk 提供的 scapy 脚本： iOS 12 / OS X 远程内核堆溢出 CVE-2018-4407 POC 在一则推文中： pip install scapy sudo scapy sendIPdst="Target IP",options=IPOption"A"8/TCPdport=2323,options=19, "1"18,19, "2"18 — Zuk @ihackbanme 2018年11月1日 它会导致运行 iOS 1...

CVE-2026-65349

CVE-2026-65349 — getattrlist OOB Write in vfsattrpackinternal Component: XNU VFS — vfsattrpackinternal getattrlist syscall Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds write to caller buffer Impact: Kernel heap corruption; from kernel conte...

CVE-2026-47513

The NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer that allows a user to perform an out-of-bounds read from kernel heap memory. Successful exploitation could result in code execution , denial of service , escalation of privileges , information di...

CVE-2026-47513

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read from kernel heap memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges,...

FreeBSD -- Heap out-of-bounds access in semop(2)

Problem Description: When semop2 blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is...

CVE-2019-6207

CVE-2019-6207 this vulneriliabity can be trigger in sandbox at macOSwop == NETRTFLAGS || w-wop == NETRTFLAGSPRIV && !rt-rtflags & w-warg goto done; / If the matching route has RTFLLINFO set, then we can skip scrubbing the MAC only if the outgoing interface is not loopback and the process has...

check_icmp_dos

checkicmpdos iOS 12 / OS X Remote Kernel Heap Overflow CVE-2018-4407 POC： pip install scapy sudo scapy sendIPdst=“Target IP“,options=IPOption“A”8/TCPdport=2323,options=19, “1"18,19, “2”18 或使用脚本 python checkicmpdos.py 127.0.0.1...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Macos

CVE-2026-43682: an HFS+ B-tree kernel heap overflow in macOS...

Linux Distros Unpatched Vulnerability : CVE-2026-97563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSiz...

kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

CVE-2026-89846

A flaw was found in the Linux kernel's scsi: qla2xxx driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol FCP response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory...

CVE-2026-13087

Rejected reason: This CVE was reserved in error and duplicates CVE-2026-89530...

UBUNTU-CVE-2026-13087

A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svcrdmasendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire...

CVE-2026-13087

A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svcrdmasendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire...

EUVD-2026-84560

A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svcrdmasendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire...