cve-2014-0038

Локальный root-эксплойт для CVE-2014-0038 Ошибка: Системный вызов X86X32 recvmmsg неправильно проверяет указатель тайм-аута, передаваемый из пользовательского пространства. Примитив эксплойта: Передача указателя на адрес ядра в качестве тайм-аута для recvmmsg. Если исходный байт по этому адресу...

cve-2016-0040

cve-2016-0040 poc pour le bug cve-2016-0040 trouvé et exploité par Meysam Firozi @R00tkitSmm ce poc aide à écrire des données arbitraires à une adresse arbitraire dans le noyau Windows pour plus d'informations, voir mon blog :...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer. Since the report buffer is used by various drivers in various ways, let’s initialize it to zero during allocation, so that it cannot ever be used to leak kernel memory through special...

CVE-2026-19185

The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...

CVE-2026-19184

The NXP GAU ADC driver drivers/adc/adcmcuxgauadc.c validated the caller-supplied sequence-buffersize, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-resultslength and used it in mcuxgauadcreadsamples as...

EUVD-2026-92286

The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...

CVE-2026-19185 Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode

The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...

CVE-2026-19185

In Zephyr RTOS builds with CONFIG_USERSPACE, a vulnerability exists in the i3c_do_ccc() system call handler within drivers/i3c/i3c_handlers.c. The system-call verifier fails to validate per-target data buffers, allowing an unprivileged user-mode thread with I3C controller access to provide arbitr...

CVE-2026-19185 Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode

The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...

EUVD-2026-92285

The NXP GAU ADC driver drivers/adc/adcmcuxgauadc.c validated the caller-supplied sequence-buffersize, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-resultslength and used it in mcuxgauadcreadsamples as...

CVE-2026-19184 Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch

The NXP GAU ADC driver drivers/adc/adcmcuxgauadc.c validated the caller-supplied sequence-buffersize, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-resultslength and used it in mcuxgauadcreadsamples as...

CVE-2026-19184 Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch

The NXP GAU ADC driver drivers/adc/adcmcuxgauadc.c validated the caller-supplied sequence-buffersize, which is expressed in bytes, against the number of active channels, which is a sample count. It then stored that byte count directly in data-resultslength and used it in mcuxgauadcreadsamples as...

CVE-2026-19184

The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) contains an out-of-bounds write vulnerability due to a mismatch between byte-based buffer size validation and sample-count logic. The driver incorrectly treats a byte count as the number of uint16_t slots, allowing a buffer to be overrun by ...

rndis-co

RNDIS-CO Краткое описание USB-гаджет RNDIS может быть использован для дампа содержимого адресного пространства ядра через механизм обновления пакетного фильтра. Описание Обработчик управляющего запроса USB RNDISMSGSET — rndissetresponse — вызывает genndissetresp, передавая указатель на буфер,...

CVE-2024-49138-POC

CVE-2024-49138-POC Исправление ошибки Decombine C:\Program Files\Microsoft Visual Studio\2022\Professional\MSBuild\Microsoft\VC\v170\Microsoft.CppBuild.targets456,5: error MSB8020: The build tools for Visual Studio 2019 Platform Toolset = 'v142' cannot be found. To build using the v142 build tool...

cve-2024-1086-lpe

cve-2024-1086-lpe Технический анализ и proof-of-concept для CVE-2024-1086, уязвимости типа use-after-free в подсистеме nftables ядра Linux, приводящей к локальному повышению привилегий. Включает разбор уязвимости, затронутые версии, методологию эксплуатации и рекомендации по смягчению последствий...

CVE-2012-6422

Эксплойт Exynos Это PoC для эксплуатации уязвимости /dev/exynos-mem, появившейся в ранних телефонах Samsung. Сделано из интереса к исследованию уязвимостей ядра и в рамках CTF-задания. Эксплойт Уязвимость, присутствующая в этих телефонах, — это права доступа к устройству exynos-mem. Оно позволяло...

CVE-2025-67246

CVE-2025-67246 Titre de vulnérabilité : LuDaShi Contrôle d'accès incorrect Versions affectées : Inférieure à 6.1026.4505.112 Date de découverte : 2 décembre 2025 Découvreur : ZhouRui Rapport d'analyse : LuDaShi est un logiciel utilitaire système gratuit bien connu qui fournit une authentification...

CVE-2022-1015

CVE-2022-1015 id uid=1000d gid=1000d groups=1000d ./poc + unshare done table created: leaktable chain created: leakchain rule added Listening on port 9999 table created: leaktable chain created: leakchain rule added Listening on port 9999 kerneladdress: ffffffffb4a00000 kernelstack:...

CVE-2017-5123

README Примечание : Код в этом репозитории предназначен для демонстрации изоляции технологий защищённой песочницы для подов, таких как kata containers, и не направлен на атаку на какие-либо платформы. Как воспроизвести Получить ядро Linux 4.13.0 Применить патч...