34 matches found
ctl_ctloutput-leak
ctlctloutput-leak macOS High Sierra 10.13 中的 ctlctloutput 函数忽略了 sooptcopyin 调用的返回值，这打开了一个竞态窗口，可将未初始化的内核堆数据泄漏到用户空间。ctlctloutput-leak 是一个概念验证漏洞利用，试图触发此信息泄漏。利用需要 root 权限。 已确认该漏洞利用在 macOS High Sierra 10.13.1 Beta 17B25c 和 iOS 10.1.1 14B100（通过 machportal）上有效。 漏洞：CVE-2017-13868 以下是 macOS High Sierra...
CVE-2019-6207
CVE-2019-6207 getdirentriesattr kernel heap inofo leak 该漏洞可在沙盒中触发，影响 macOS=10.14.4 && ios 12.2 我将很快更新关于此漏洞的更多细节。...
CVE-2026-89743 misc: nsm: bound the device-reported response length
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...
kernel: smb/client: fix out-of-bounds read in smb2_compound_op()
A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker, acting as a malicious SMB server, could send a specially crafted, truncated response with an oversized buffer length. This could lead to an out-of-bounds read in the smb2compoundop function, allowing the...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098929)
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098929 advisory. In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated R...
CVE-2026-74278
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...
CVE-2026-74278
CVE-2026-74278 affects the Linux kernel ALSA seq subsystem. The leak arises from bounce_error_event() always emitting SNDRV_SEQ_EVENT_KERNEL_ERROR with a raw struct snd_seq_event pointer exposed to users. The fix differentiates by client type: for USER_CLIENTS, send SNDRV_SEQ_EVENT_BOUNCE with SN...
Linux Distros Unpatched Vulnerability : CVE-2026-74278
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE wi...
AZL-94040 CVE-2026-64540 affecting package kernel for versions less than 6.6.145.2-1
In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by...
UBUNTU-CVE-2026-64479
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in sndseqeventdup sndseqeventdup copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell-ump.raw.extra word that the memcpy did not cover. The guard...
CVE-2026-10677
The CVE concerns Zephyr’s CONFIG_USERSPACE verifier z_vrfy_k_poll() in kernel/poll.c, where a user-supplied k_poll_event[] is copied to kernel space and validated. Previously, an inline K_OOPS(K_SYSCALL_OBJ(...)) inside the loop could leak the allocation when a forged object handle was encountere...
CVE-2026-10677 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool
The CONFIGUSERSPACE syscall verifier zvrfykpoll in kernel/poll.c allocates a kernel-side copy of the user-supplied kpollevent via zthreadmalloc and then validates each event's object handle. Before this fix, validation used KOOPSKSYSCALLOBJ... inline inside the loop, which kills the calling threa...
CVE-2026-10677 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool
The CONFIGUSERSPACE syscall verifier zvrfykpoll in kernel/poll.c allocates a kernel-side copy of the user-supplied kpollevent via zthreadmalloc and then validates each event's object handle. Before this fix, validation used KOOPSKSYSCALLOBJ... inline inside the loop, which kills the calling threa...
Linux kernel 安全漏洞
The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from an out-of-bounds read in the smb2compoundop function within the smb client. This vulnerability ma...
CVE-2026-45252
When a fusefs file system implements extended attributes, the kernel may send a FUSELISTXATTR message to the userspace daemon to retrieve the list of extended attributes for a given file. The FUSE protocol requires the daemon to return a packed list of NUL-terminated strings. The fusefs kernel...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed the off-by-8 bounds check in checkwsleas The bounds check uses u8 ea + nlen + 1 + vlen as the end of the EA name and value. However, eadata is located at offset sizeofstruct smb2filefulleainfo = 8 from ea, not ...
CVE-2026-31614
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check in checkwsleas The bounds check uses u8 ea + nlen + 1 + vlen as the end of the EA name and value, but eadata sits at offset sizeofstruct smb2filefulleainfo = 8 from ea, not at offset 0. The...
CVE-2026-31664 xfrm: clear trailing padding in build_polexpire()
In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in buildpolexpire buildexpire clears the trailing padding bytes of struct xfrmuserexpire after setting the hard field via memsetafter, but the analogous function buildpolexpire does not do this for...
CVE-2021-0698
In PVRSRVBridgeHeapCfgHeapDetails, there is a possible leak of kernel heap content due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroi...
