CVE-2021-31166-Exploit

CVE-2021-31166-Exploit 针对MS HTTP协议栈RCE漏洞（CVE-2021-31166）的利用程序 精心构造的HTTP请求指向存在漏洞的Windows版本将导致DOS攻击。服务器将以蓝屏错误重启。 Http.sys是Windows内核驱动程序，负责处理HTTP请求并构造响应。 此存在漏洞的http.sys驱动程序无法处理特制的"Accept-Encoding"头部，导致崩溃，进而服务器重启。 在蓝屏上，我们可以看到错误信息"停止代码: KERNEL SECURITY CHECK FAILED" 这是一个严重漏洞，CVSS评分为9.8，易于利用。...

Exploit for Use After Free in Microsoft

CVE-2021-31166-Exploit Exploit for MS Http Protocol Stack RCE...

NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5 Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 = globalarrayv5...

NVIDIA Driver - No Bounds Checking in Escape 0x7000170 Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=936 The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writing...

NVIDIA Driver - No Bounds Checking in Escape 0x7000170

NVIDIA Driver - No Bounds Checking in Escape 0x7000170 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=936 The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writin...

NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 = globalarrayv5 + 77; while v2 size 0 do ii = i++; globalarrayii +...