Microsoft Windows NT User Mode To Ring 0 Escalation

Microsoft Windows NT GP Trap Handler Allows Users to Switch Kernel Stack ------------------------------------------------------------------------- CVE-2010-0232 In order to support BIOS service routines in legacy 16bit applications, the Windows NT Kernel supports the concept of BIOS calls in the...

Microsoft Windows NT200020032008XPVista7 - KiTrap0D User Mode to Ring Escalation (MS10-015)

Microsoft Windows NT200020032008XPVista7 - KiTrap0D User Mode to Ring Escalation MS10-015 Exploit-DB Mirror: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/11199.zip KiTrap0D.zip E-DB Note: Make sure to run "vdmallowed.exe" pre-compiled inside the subfolder...

Windows NT User Mode to Ring 0 Escalation Vulnerability

Exploit for unknown platform in category local exploits ======================================================= Windows NT User Mode to Ring 0 Escalation Vulnerability ======================================================= Microsoft Windows NT GP Trap Handler Allows Users to Switch Kernel Stack...

Fedora Core 11 FEDORA-2009-10639 (kernel)

The remote host is missing an update to kernel announced via advisory FEDORA-2009-10639. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...

CVE-2009-2911

SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to 1 cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, 2 cause a denial of service...

CVE-2009-2911

SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to 1 cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, 2 cause a denial of service...

Stack overflow

SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to 1 cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, 2 cause a denial of service...

CVE-2009-2911

CVE-2009-2911 affects SystemTap 1.0 when run in --unprivileged mode, with root cause described as improper restriction of data sizes leading to kernel stack/frames overflow and DoS via large argument lists, DWARF processing, or unwind table growth. Multiple connected advisories (openSUSE OSV-OPEN...

CVE-2009-2911

SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to 1 cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, 2 cause a denial of service...

CVE-2009-2911

SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to 1 cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, 2 cause a denial of service...

USN-852-1: Linux kernel vulnerabilities

Solar Designer discovered that the z90crypt driver did not correctly check capabilities. A local attacker could exploit this to shut down the device, leading to a denial of service. Only affected Ubuntu 6.06. CVE-2009-1883 Michael Buesch discovered that the SGI GRU driver did not correctly check...

kernel: information leak in sigaltstack

The dosigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack...

NetBSD 5.0.1 - 'IRET' General Protection Fault Handling Privilege Escalation

/ source: https://www.securityfocus.com/bid/36430/info NetBSD is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to cause the kernel stack to become desynchronized. This may allow the attacker to gain elevated privileges or may aid in further attacks. ...

NetBSD 5.0.1 - IRET General Protection Fault Handling Privilege Escalation

NetBSD 5.0.1 - IRET General Protection Fault Handling Privilege Escalation / source: https://www.securityfocus.com/bid/36430/info NetBSD is prone to a local privilege-escalation vulnerability. A local attacker may exploit this issue to cause the kernel stack to become desynchronized. This may all...

Linux Kernel 'net/llc/af_llc.c'本地信息泄漏漏洞

Bugraq ID: 36126 Linux是一款开放源代码的操作系统。 AFLLC包含的getsockname存在未初始化问题，可导致泄漏5个字节的未初始化内核堆栈。 攻击者可借此获得敏感信息。 Linux kernel 2.6.31 -rc7 Linux kernel 2.6.31 -rc6 Linux kernel 2.6.31 -rc3 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Linu...

Linux Kernel 2.6.31-rc5 - sigaltstack 4-Byte Stack Disclosure

Linux Kernel 2.6.31-rc5 - sigaltstack 4-Byte Stack Disclosure / sigaltstack-leak.c Linux Kernel http://jon.oberheide.org Information: http://git.kernel.org/linus/0083fc2c50e6c5127c2802ad323adf8143ab7856 Ulrich Drepper correctly points out that there is generally padding in the structure on 64-bit...

Linux Kernel <= 2.6.31-rc5 sigaltstack 4-Byte Stack Disclosure Exploit

Exploit for linux platform in category local exploits ====================================================================== Linux Kernel include include include include include include include include const int randcalls = 0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 13, 14, 16, 21, 22, 24, 25, 32, 33, 36...

Windows Vista iphlpapi.dll本地内核栈溢出漏洞

BUGTRAQ ID: 32357 Windows Vista是微软发布的最新版本的操作系统。 在使用CreateIpForwardEntry2方式向IPv4路由表添加路由项时，如果对MIBIPFORWARDROW2结构所包含的DestinationPrefix结构中的目标PrefixLength成员传送了大于32的非法值的话，就会破坏内核空间内存，导致随机的蓝屏崩溃。传送的非法值越大，所触发的崩溃就会越快出现。 此外如果使用系统自带的route add命令并在子网掩码中使用了非法值的话，该命令也可以触发相同的缓冲区溢出。 Microsoft Windows Vista Microsof...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise MRG 1.0. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

Cisco VPN Client - IPSec Driver Local kernel system pool Corruption (PoC)

/ cpndrv-dos.c Copyright c 2008 by Cisco Systems VPN Client IPSec Driver local kernel system pool corruption POC by mu-b - Sat 11 Jan 2008 - Tested on: CVPNDRVA.sys 5.0.02.0090 specifying an input buffer size less-than 8+31-bytes results in the local kernel non-paged pool METHODBUFFERED being...