flow_divert-heap-overflow

flowdivert-heap-overflow flowdivert-heap-overflow 是针对 CVE-2016-1827 的概念验证漏洞利用，该漏洞已在 OS X El Capitan 10.11.5 和 iOS 9.3.2 中修复。 该漏洞是函数 flowdiverthandleappmapcreate 中针对用户空间提供的不可信长度进行的一系列未检查算术运算。利用该漏洞需要 root 权限。 此概念验证会在 OS X Yosemite 10.10.5 上触发内核恐慌。在 El Capitan 中，长度字段已从 64 位改为 32...

CVE-2026-80825

CVE-2026-80825 affects the Linux kernel mt76 WiFi driver for mt7925 USB/SDIO devices (mt7925u). The function mt7925_usb_sdio_tx_prepare_skb() pushes a TX descriptor and USB header onto every skb, assuming sufficient headroom is already present. This assumption holds for locally generated traffic ...

CVE-2026-80809

CVE-2026-80809 affects the Linux kernel's ocfs2 filesystem . The root cause is that ocfs2_calc_xattr_set_need() fails to reserve metadata blocks for a new xattr value's extent tree when the file already has an external xattr block, leaving meta_ac as NULL. On a fragmented filesystem , this causes...

CVE-2026-28992-IOHIDFamily-FastPathUserClient-Race-Conditions

CVE-2026-28992: Condiciones de carrera en IOHIDFamily FastPathUserClient CVE-2026-28992 | Autor: Johnny Franks @zeroxjf Componente: IOHIDFamily Impacto: Un atacante podría provocar la terminación inesperada de una app Descripción: Se corrigió un problema de corrupción de memoria mejorando el...

CVE-2017-6074-DOS

CVE-2017-6074 - 仅DoS利用 Linux DCCP内核恐慌 此仓库提供了原始CVE-2017-6074漏洞利用（Linux内核DCCP子系统中的释放后使用）的修改版本，专门用于展示拒绝服务（DoS）影响。 经过身份验证的本地用户可以触发内核恐慌 ，导致系统完全不可用。 不尝试也不实现 权限提升。 利用需要本地用户访问权限（例如通过SSH）。 仅用于安全研究、PoC演示和受控测试环境。 参考 CVE-2017-6074 CWE-416: 释放后使用 免责声明 ⚠️ 仅在授权的测试系统上运行此代码。此程序将立即导致内核崩溃。 使用风险自负，本人不对不良使用负责。...

ScreenOff

ScreenOff PoC de caída del kernel CVE-2026-52910. ref: https://github.com/5unkn0wn/security-research/tree/CVE-2026-52910ltscosmitigation qué Condición de carrera entre socket + SOATTACHREUSEPORTCBPF + setsockopt. La tormenta de callbacks de timerfd/epoll ralentiza la ruta de recepción. Reemplaza...

CVE-2024-27804

CVE-2024-27804 root@kitploit: ./build.sh ./panic.sh root@kitploit: paniccpu 4 caller 0xfffffe0026851cdc: Unaligned kernel data abort. at pc 0xfffffe0026aed514, lr 0xfffffe0026aed5d8 saved state: 0xfffffe3a396e3200 x0: 0x000000000000000e x1: 0xfffffe1002bdc01b x2: 0x0000000000000000 x3:...

CVE-2025-39866

CVE-2025-39866 - use-after-free Author: Byte Reaper Description This POC attempts to exploit the CVE-2025-39866 vulnerability, which is a flaw in Linux systems iwb” and schedules the critical free via “wbputmany”. step 3 : - thread 2 : free wbolb - thread 1 - pointer - free object wb free old -...

IOHIDFamily-PoC-Research

CVE-2026-28992 — IOHIDFamily FastPathUserClient PoC 安全研究仓库。两个PoC应用演示了 IOHIDFamily 的 FastPathUserClient 在 iOS 18.7.1 及更早版本上的竞态条件。 ⚠️ 两个PoC都会导致内核恐慌并重启你的设备。请先保存你的工作。 漏洞摘要 字段| 详情 ---|--- CVE| CVE-2026-28992 组件| IOHIDFamily — IOHIDEventServiceFastPathUserClient 类型| 内存损坏（竞态条件 / UAF） 可达性| 普通应用沙盒，无需任何权限...

CVE-2022-36946

CVE-2022-36946 报告人：Domingo Dirutigliano 和 Nicola Guerrera 当我们在开发 firegex（我们为 CTF 攻防竞赛开发的应用程序防火墙）时，偶然发现了几次内核崩溃。 这个奇怪的行为随后被隔离和分析，最终发现了 netfilter 模块中（特别是 nfnetlink）的这一个潜在安全缺陷。 它是如何工作的？ 当发送带有 0 字节 nftapayload 属性的 nfqueue 裁决时，内核会发生崩溃。 root@kitploit: nlh = nfqnlmsgputbuf, NFQNLMSGVERDICT, queuenum;...

CVE-2026-43499-PoC-Scanner

CVE-2026-43499 PoC Scanner This repository contains a Go-based scanner and proof-of-concept implementation for a Linux kernel vulnerability related to CVE-2026-43499. The project is intended for research, defensive analysis, and authorized security testing only. Overview The code in this reposito...

kernel: NFSv4/flexfiles: reject zero filehandle version count

A flaw was found in the Linux kernel's NFSv4 Network File System version 4 flexfiles component. This vulnerability occurs when the fflayoutalloclseg function processes a malformed flexfiles layout that specifies a zero filehandle version count. An attacker could exploit this by providing a...

CVE-2017-2671

Linux kernel CVE-2017-2671 로컬 서비스 거부 취약점 뭐라고 !! CVE-2017-2671 1 Linux kernel CVE-2017-2671 로컬 서비스 거부 결과적으로 disconnect 함수 호출이 안전하다는 것을 보장할 수 없으며, 이로 인해 로컬 사용자가 socket 시스템 호출에서 IPPROTOICMP의 프로토콜 값에 접근을 활용하여 서비스 거부패닉를 유발할 수 있습니다. 취약한 버전: Ubuntu Ubuntu Linux 16.04 LTS ✅ Redhat Enterprise Mrg 2 ✅ Redh...

GenEtherExploit

ES GenEtherExploit es un exploit de prueba de concepto PoC para la vulnerabilidad de macOS CVE-2023-40404. Este PoC utiliza las APIs de IOKit para interactuar con el servicio de red IOUserEthernetResource, manipulando las interfaces de red del sistema. El propósito de este exploit es demostrar un...

sysctl_coalition_get_pid_list-dos

sysctlcoalitiongetpidlist-dos La función sysctlcoalitiongetpidlist en bsd/kern/syscoalition.c utiliza la función coalitiongetpidlist para recopilar una lista de PIDs en una coalición. Esta función devolverá el número de PIDs si tiene éxito o un errno negativo en caso de fallo. Sin embargo, la...

RowHammer-Exploit

RowHammer-Exploit Exploit basado en RowHammer backdoor de syssuid usando rowhammer Todavía necesita trabajo... averiguar por qué las cosas no funcionan correctamente... root@kitploit: Current stage... Denial fails with the following stack trace... UG: unable to handle kernel paging request at...

CVE-2026-80730

CVE-2026-80730 affects the Linux kernel's ring-buffer subsystem. The root cause is in test_ringbuffer()'s out_free cleanup loop: the !rb_threads[cpu] check only catches NULL entries but misses entries holding an ERR_PTR . When kthread_run_on_cpu() fails, it stores ERR_PTR(-ENOMEM) or ERR_PTR(-EIN...

EUVD-2026-70334

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing ERRPTR to kthreadstop In testringbuffer's outfree cleanup loop, the check !rbthreadscpu only catches NULL entries and misses entries that hold an ERRPTR. rbthreads is static, so unassigned slots are...

kernel: NFSv4/flexfiles: reject zero filehandle version count

A flaw was found in the Linux kernel's NFSv4 Network File System version 4 flexfiles component. This vulnerability occurs when the fflayoutalloclseg function processes a malformed flexfiles layout that specifies a zero filehandle version count. An attacker could exploit this by providing a...

CVE-2022-42864

CVE-2022-42864: Diabolical Cookies What is this repo? This is my incomplete proof-of-concept exploit for CVE-2022-42864, a time-of-check-time-of-use vulnerability in IOHIDFamily that was fixed in iOS 16.2 / macOS Ventura 13.1. What is the status of the proof-of-concept? The exploit currently...