kernel: nvme: add missing SRCU grace period in error path

A flaw was found in the NVMe Non-Volatile Memory Express driver of the Linux kernel. The nvmeallocns function's error handling path fails to wait for all SRCU Sleepable Read-Copy Update readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a...

kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition

A use-after-free flaw was identified in the Linux kernel’s media tuner xc5000 driver. In the vulnerable code path, xc5000release calls canceldelayedwork to cancel a pending delayed work item timersleep without guaranteeing that the work handler has fully completed. Under a race condition, the...

kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation

A flaw was found in the Linux kernel's Quick Fair Queuing QFQ scheduler. The QFQ class deactivation logic incorrectly relies on a child qdisc's queue length qlen to determine if a class is active. A local user with CAPNETADMIN capabilities can manipulate the child qlen into an unexpected state...

kernel: nvme-tcp: fix host memory disclosure on R2T for a read command

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

A flaw was found in the Linux kernel's netfilter connection tracking subsystem. The TCP option processing mechanism improperly assumes memory alignment when reading packet headers. A remote attacker could exploit this vulnerability by sending crafted TCP packets with misaligned SACK options throu...

kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

A flaw was found in the Linux kernel's tunnels module. This vulnerability, categorized as a Use-After-Free UAF, arises from improper handling of network header pointers during certain packet processing operations. Specifically, functions responsible for building Internet Control Message Protocol...

kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's IP Generic Routing Encapsulation ipgre component. This vulnerability allows a local attacker with network administration capabilities in one network namespace to modify a tunnel residing in a different network namespace where they lack privileges. This is du...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the ibuverbspostsend function. A local user can exploit this vulnerability by providing an invalid work queue element size wqesize from userspace without proper validation. This can lead to an...

kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

A flaw was found in the Linux kernel's tunnels module. This vulnerability occurs when the iptunnelpmtudcheckicmp function is called without the skb transport header being properly set. An attacker could exploit this condition to trigger an out-of-bound memory access, which may lead to system...

kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...

kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list

A flaw was found in the Linux kernel's mlx5 driver. The mlx5querynicvportmaclist function, which handles querying network interface card NIC virtual port vport MAC addresses, incorrectly sizes its internal buffer. When a Virtual Function VF vport is queried with a larger configured maximum, the...

kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM module, specifically within the Secure Virtual Machine SVM component. The sevdbgcrypt function, when handling encryption, incorrectly calculates the transfer length, leading to a page overflow. This memory corruption can resu...

kernel: nvme-pci: fix mempool alloc size

A flaw was addressed in the Linux kernel’s nvme-pci driver related to how the driver calculated the worst-case number of PRP Physical Region Page lists required for a given I/O request. The implementation previously rounded the allocation to one list instead of correctly converting the maximum si...

kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA bnxtre driver. A local user could exploit a race condition that occurs when a Queue Pair QP is destroyed, but completion queue CQ polling continues. This can lead to a kernel panic, resulting in a Denial of Service DoS on the...

INF8602-CVE-2020-8835

INF8602-CVE-2020-8835 커널 익스플로잇 테스트 1. Docker 없이 테스트 cd ../app npm i node server.js 2. Docker로 방어 능력 테스트 Make sure to be in the same directory as the Dockerfile Build the Docker image docker build . -t inf8602/node-web-app Your docker image should be listed by Docker docker images Run the image...

linux-4.1.15_CVE-2022-42703

리눅스 커널 릴리스 4.x http://kernel.org/ 이것은 리눅스 버전 4의 릴리스 노트입니다. 이것이 무엇인지 설명하고, 커널을 설치하는 방법과 문제가 발생했을 때 해야 할 일을 알려주므로 주의 깊게 읽어주세요. 리눅스란 무엇인가? 리눅스는 유닉스 운영 체제의 클론으로, 리누스 토발즈가 인터넷 곳곳의 느슨하게 연결된 해커 팀의 도움을 받아 처음부터 작성했습니다. POSIX 및 Single UNIX Specification 준수를 목표로 합니다. 진정한 멀티태스킹, 가상 메모리, 공유 라이브러리, 요구 로딩, 공유...

CVE-2022-0492-Docker-Breakout-Checker-and-PoC

CVE-2022-0492 Docker 탈출 확인기 및 PoC 요약 이 취약점을 악용하려면 공격자가 취약한 시스템에서 실행 중인 Docker 컨테이너에 접근할 수 있어야 합니다. 악용에 성공하면 공격자는 컨테이너를 탈출하여 호스트 시스템에 대한 완전한 제어 권한을 얻을 수 있습니다. Linux 커널의 kernel/cgroup/cgroup-v1.c 함수인 cgroupreleaseagentwrite에서 취약점이 발견되었습니다. 이 결함은 특정 상황에서 cgroups v1의 releaseagent 기능을 이용하여 예기치 않게 권한을...

CVE-2022-36946

CVE-2022-36946 보고자: Domingo Dirutigliano and Nicola Guerrera firegex CTF Attack-Defence 대회용 애플리케이션 방화벽 작업을 하던 중 몇 가지 커널 패닉을 발견했습니다. 이상한 동작을 격리하고 분석한 결과, netfilter 모듈, 특히 nfnetlink에서 잠재적인 보안 결함을 발견했습니다. 작동 방식 nfqueue verdict를 0바이트 nftapayload 속성과 함께 보내면 커널이 패닉 상태가 됩니다. nlh = nfqnlmsgputbuf,...

DIRTY-FRAG-Detection-with-Wazuh-4.14.4

Wazuh 4.14.4를 이용한 DIRTY FRAG 탐지 - CVE-2026-43284 / CVE-2026-43500 Dirty Frag 커널 LPE를 위한 탐지 엔지니어링 - Ubuntu / RHEL / Debian / Amazon Linux Dirty Frag란 무엇인가? CVE-2026-43284 / CVE-2026-43500은 권한이 없는 사용자 계정에서 루트 권한을 얻기 위해 두 개의 독립적인 page-cache 쓰기 프리미티브를 체이닝하는 Linux 커널 로컬 권한 상승LPE 취약점입니다. 단일 컴파일 바이너리로 모...