schrodingers-toctou

Schrödinger's TOCTOU "...'정상적인 컴파일러'의 정의는 점점 더 느슨해진다." 여러분이 실행하는 바이너리는 여러분이 작성한 프로그램이 아니다. 컴파일러 최적화기는 소스를 여러분이 결코 보지 못할 방식으로 다시 작성하며 — 그러한 변경 중 일부는 조용하고도 합법적으로 겉보기에는 안전한 코드를 취약한 바이너리로 바꿀 수 있다. 같은 코드 줄은 한 컴파일러에서는 안전하고 다른 컴파일러에서는 공격에 취약할 수 있으며, 소스에는 어느 쪽인지 알려 줄 것이 없다: 그 취약성은 중첩 상태에 있다가 빌드할 때에만 붕괴된다...

gustave

c Airbus 2021, sduverger GUSTAVE - Embedded OS kernel fuzzer What is it ? GUSTAVE is a fuzzing platform for embedded OS kernels. It is based on QEMU and AFL and all of its forkserver siblings. It allows to fuzz OS kernels like simple applications. Thanks to QEMU, it is multi-platform. One can see...

CVE-2021-4154

CVE-2021-4154 Ce bug a été corrigé dans https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0462726e7ef281c35a7a4ae33e93ee2bc9975b Cet exploit fonctionne sur la plupart des noyaux antérieurs au correctif pour : Les noyaux CentOS 8 supérieurs à linux-4.18.0-305.el8 Les...

CVE-2023-2640-32629

Повышение привилегий в Ubuntu: CVE-2023-2640 и CVE-2023-32629 Это локальная уязвимость повышения привилегий, затрагивающая некоторые ядра Ubuntu. Она позволяет непривилегированным пользователям устанавливать привилегированные расширенные атрибуты на смонтированных файлах, обходя проверки...

exploits

익스플로잇 n-day, CTF, 제로데이, 커널, 브라우저와 그 밖에 재미있는 것들이 가득한 개인 익스플로잇 컬렉션입니다 :D...

CVE-2024-1086

CVE-2024-1086 Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images...

ptxNinja

ptxNinja Автор : Nicolò Altamura Исследуйте код PTX с помощью Binary Ninja Описание ptxNinja — это плагин архитектуры для Binary Ninja, ориентированный на PTX, язык виртуальной архитектуры GPU на базе CUDA. Это позволяет вам: исследовать бинарные файлы PTX, интегрируя уже доступные в сообществе...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

Transmitted requests in Xen’s virtual network protocol can consist of multiple parts. Although none of them are actually useful, except for the initial part, any of these parts can be of zero length, meaning they carry no data at all. Apart from the certain initial portion of the data to be...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Tracing/histograms: Fixed the memory leak issue. This issue was fixed in commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As mentioned in commit 46bbe5c671e0 “Tracing: fixing double-free”, the “double-free” problem reported by th...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: erofs: Fix for lz4 inplace decompression Currently, EROFS can map another compressed buffer for inplace decompression, which was used to handle cases where some pages of compressed data are not actually in-place I/O. However, lik...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: socinfo: Added kfree in kstrdup. Added kfree in the subsequent error handling steps to avoid memory leaks...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to the cacheinfo array The loop that detects/populates cache information already includes a check on the array size. However, it does not take into account cache levels with separate...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Tracing: Verify event formats that use "%p.." syntax. The trace event verifier checks the formats of trace events to ensure that they do not reference memory that is not part of the event itself, or data that will never be freed...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: Roles – Fixed NULL pointer issue when referencing the module’s reference. In the current design, the USB role class driver will obtain a reference to the module of the usbroleswitch object after the user selects the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the drivers/video/fbdev/smscufx.c file within the Linux kernel, up to version 5.19.12, there is a race condition that can lead to a use-after-free if a physically nearby attacker removes a USB device while the open function is called. This issue is essentially a race condition between ufxopsop...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath11k – Fix for htt.pktlog locking. The ath11k active PDevs are protected by RCU, but the code that handles htt.pktlog, namely ath11kmacgetarbypdevid, was not marked as a read-side critical section. Mark the relevant code ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A deadlock flaw was discovered in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: fix some memleaks in tpgalloc. In tpgalloc, resources should be deallocated in every possible error-handling path, as they are allocated using for statements. Otherwise, memleaks could occur, since tpgfree is onl...

Astra Linux – Vulnerability in Linux, Linux-6.1

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs: Ovlcopyupmeta inodedata function skips permission checks when calling ohldosetxattr on Ubuntu kernels...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A memory read flaw that is outside the safe bounds was discovered in receiveencryptedstandard in fs/smb/client/smb2ops.c, within the SMB Client sub-component of the Linux kernel. This issue arises due to an integer underflow occurring during the memcpy operation’s length calculation, resulting in...