CVE-2017-16995

CVE-2017-16995 Ubuntu 16.04.01 - Linux 4.4.0-31-generic 50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x8664에서 테스트됨 이 취약점은 일반 사용자가 권한 상승을 통해 루트 셸을 획득할 수 있게 합니다. 커널이 다른 경우 CRED 오프셋을 조정하고 커널 스택 크기를 확인하십시오...

CVE-2022-32250-exploit

CVE-2022-32250-Linux-Kernel-LPE 데모 비디오 https://www.youtube.com/watch?v=YqmwA6fPjKE 소개 CVE-2022-32250은 잘못된 NFTSTATEFULEXPR 검사로 인해 use-after-free가 발생하여 로컬 사용자가 root로 권한 상승할 수 있습니다. 참고 리눅스 Kerenel 익스플로잇 CVE-2022-32250 with mqueue 영향을 받는 버전 리눅스, 커밋 520778042ccca019f3ffa136dd0ca565c486cedd 이전 2022년 5월...

2009

2009 Linux 커널 익스플로잇 - CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547...

vsock_poc

vsockpoc CVE-2021-26708 뒤에 숨은 버그 조사 이 저장소는 CVE-2021-26708에 대한 간단한 분석과 이 버그를 Use After Free 쓰기 프리미티브로 전환하는 방법을 담고 있습니다. 여기 있는 PoC는 완전한 익스플로잇이 아니라, 제가 이 버그를 조사할 때 사용한 테스트 환경입니다. kmalloc-64 캐시에서 해제된 엔트리를 성공적으로 사용할 수 있지만, 메모리를 정리하고 슬롯에 흥미로운 무언가를 배치하는 코드는 없습니다. @a13xp0p0v가 보고한 재미있는 버그입니다. 패치가 너무 단순해서 ...

kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done()

In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handleauthdone Perform an explicit bounds check on payloadlen to avoid a possible out-of-bounds access in the callout. idryomov: changelog...

kernel: net: qrtr: restrict socket creation to the initial network namespace

A flaw was found in the Linux kernel's QRTR Qualcomm IPC Router networking component. An unprivileged local attacker can create a QRTR socket in a separate network namespace. Due to improper handling of global state variables, this allows the attacker to send datagrams and control-plane messages ...

kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface VTI module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect...

kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

A flaw was found in the Linux kernel's crypto QAT QuickAssist Technology module. A race condition exists during the teardown of Virtual Function to Physical Function VF2PF work in the adfdisablesriov function. This allows a concurrently scheduled or already queued worker to attempt to access memo...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests

A flaw was found in the Linux kernel's pcrypt component. This vulnerability involves how the system handles certain requests, specifically MAYBACKLOG requests, which can indicate a temporary busy state. If not properly managed, the system's processing of these requests could lead to resource...

kernel: Linux kernel: Denial of Service in erofs filesystem

A flaw was found in the Linux kernel's erofs filesystem. A remote attacker can exploit this vulnerability without requiring any privileges. This issue occurs when insufficient memory during a memory mapping operation vmmapram in the bio completion path leads to a deadlock, causing a Denial of...

kernel: ALSA: 6fire: fix use-after-free on disconnect

A flaw was found in the Linux kernel's ALSA 6fire USB audio device driver. During the disconnection process of a 6fire USB audio device, a use-after-free vulnerability occurs. This happens when the system attempts to write to memory that has already been deallocated, which can lead to memory...

kernel: xfrm: input: hold netns during deferred transport reinjection

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...

kernel: tipc: fix double-free in tipc_buf_append()

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...

kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability arises when asynchronous cryptographic operations incorrectly handle network packet segments, leaving a pointer to memory that has already been released. An attacker could potentially exploit this use-after-free condition t...

kernel: dm-verity: fix buffer overflow in FEC calculation

A flaw was found in the dm-verity component of the Linux kernel. A buffer overflow occurs during Forward Error Correction FEC calculation, allowing an attacker to write past the end of an allocated buffer. This out-of-bounds write can corrupt the syndrome buffer, potentially leading to system...

Check-for-CVE-2023-32629-GameOver-lay

CVE-2023-32629 GameOverlay 확인 스크립트 개요: 이 스크립트는 GameOverlay 결함과 관련된 취약점을 탐지하기 위해 Ubuntu 시스템에서 보안 검사를 수행하도록 설계되었습니다. Linux 커널의 OverlayFS 모듈에 존재하는 두 가지 특정 취약점CVE-2023-2640 및 CVE-2023-32629을 확인합니다. 또한 시스템에서 OverlayFS가 사용 중인지도 확인합니다. 상세 설명: Ubuntu 서버 보안 검사기 이 스크립트는 "GameOverlay" 결함과 관련된 취약점을 탐지하기 위해...

CVE-2022-3910

CVE-2022-3910 poc dirtyfile dirtymm...

CVE-2022-0847-DirtyPipe-Exploit

CVE-2022-0847-DirtyPipe 취약점 개요 3월 7일, 해외 보안 연구원 Max Kellermann이 Linux 커널에 존재하는 로컬 권한 상승 취약점 CVE-2022-0847을 공개한 블로그를 게시했습니다: https://dirtypipe.cm4all.com/ CVE-2022-0847은 Linux 커널 5.8 이상 버전에 존재하는 로컬 권한 상승 취약점입니다. 공격자는 이 취약점을 이용하여 임의의 읽기 가능 파일의 데이터를 덮어쓰기 할 수 있으며, 이를 통해 일반 사용자 권한을 루트 권한으로 상승시킬 수 있습니다...