CVE-2025-32463-PoC

CVE-2025-32463 – 通过 sudo chroot 实现权限提升 📝 概述 CVE-2025-32463 是一个影响 sudo 工具的本地权限提升漏洞。 它允许普通用户通过利用 -R 选项（设置自定义运行时根目录）并结合被操纵的 NSS 配置，将权限提升至 root。 CVE 编号： CVE-2025-32463 组件： sudo 影响： 本地权限提升（root） 发现者： Rich Mirch 🚨 风险与影响 成功利用该漏洞可使低权限本地用户获得完全的 root 访问权限，彻底突破系统安全边界。 🔬 测试漏洞利用 使用示例 git clone...

CVE-2015-1328

CVE-2015-1328 概念验证 CVE-2015-1328 的漏洞利用概念验证（PoC），这是一个影响 Linux 内核 overlayfs 实现的权限提升漏洞。该漏洞允许本地非特权用户通过利用用户命名空间中 overlayfs 挂载操作的不当权限检查来获得 root 权限。 概述 CVE-2015-1328 是一个严重的安全漏洞，影响启用了 overlayfs 支持和用户命名空间的 Linux 内核。该漏洞允许非特权本地用户： 1. 使用 unshareCLONENEWUSER 创建用户命名空间 2. 在命名空间内挂载 overlayfs 文件系统 3. 利用权限检查缺陷写入...

CVE-2025-32463

CVE-2025-32463 检测框架 一个全面的安全监控与检测框架，专为识别针对 sudo chroot 权限提升漏洞（CVE-2025-32463）的利用尝试而设计。本项目展示了先进的威胁检测方法、应急响应能力及防御性安全工程。 🔍 概述 CVE-2025-32463 是 sudo 1.9.14 至 1.9.17 版本中的一个关键权限提升漏洞，允许本地用户通过操纵 /etc/nsswitch.conf 并在使用 --chroot 选项时获取 root 权限。此框架为安全运营团队提供了实时检测能力与取证分析工具。 CVSS 评分： 9.3（严重） CWE 分类：...

MagiskEoP

简介 这是 Magisk 应用中一个针对漏洞 CVE-2024-48336 的利用程序，允许本地应用在未经用户同意的情况下静默获取 root 权限。 该漏洞最初由 @vvb2060 报告，并由 @canyie 编写了 PoC。该漏洞已在 Canary 27007 版本中修复。 利用此漏洞静默获取 root 权限并向任意应用授予 root 权限的演示视频：https://github.com/canyie/MagiskEoP/blob/main/screen-20220302-093745.mp4 复现此漏洞的步骤： 1. 在没有预装 GMS 的设备上安装存在漏洞的 Magisk 应用构建...

CVE-2021-3560

Polkit 漏洞 - CVE-2021-3560 📕 介绍 2021 年，一位名叫 Kevin BackHouse 的研究人员在 polkit 工具中发现了一个权限提升漏洞。然而，并非所有 Linux 版本都容易受到 polkit 漏洞的影响。 以下是一个易受攻击版本的示例； Red Hat Enterprise Linux 8 Fedora 21（或更高版本） Debian Testing（"Bullseye"） Ubuntu 20.04 LTS（"Focal Fossa"） 大多数最新的 Linux 版本已经修复了此漏洞，但如上所述的较旧版本仍然存在此漏洞。 那么什么是 Polki...

AlmaLinux 9.2 [TuxCare] Security Update: cloud-init Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1760018787)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760018787 advisory. - cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666...

Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow

使用 Dirty Cow 内核漏洞进行权限提升 本项目旨在通过实践演示 Dirty COW（CVE-2016-5195）漏洞的运行机制，这是 Linux 内核中一个关键漏洞。它模拟了一个真实的攻击场景：攻击者仅拥有受限的本地访问权限，却能利用未打补丁的系统，将权限提升至完全 root 访问权限。...

EUVD-2026-75594

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: pcp (UTSA-2026-093145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093145 advisory. A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise Hi...

EUVD-2026-54262

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock for POCO M6 Pro emerald GhostLock CVE-2026-43499...

CVE-2026-12504 Loytec LINX firmware: Improper Authentication in PAM configuration

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2724)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871...

EulerOS Virtualization 2.10.0 : dnsmasq (EulerOS-SA-2026-2848)

According to the versions of the dnsmasq package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary...

EulerOS Virtualization 2.12.0 : util-linux (EulerOS-SA-2026-2810)

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check- Time-of-Use vulnerabilit...

CVE-2026-47134 ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database /Library/Application Support/clearancekit/store.db is stored in the macOS System Keychain. The key was created via the two-step patte...

EulerOS 2.0 SP10 : dnsmasq (EulerOS-SA-2026-2645)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root...

TencentOS Server 4: cifs-utils (TSSA-2026:0552)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0552 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Amazon Linux 2 : dnsmasq, --advisory ALAS2-2026-3318 (ALAS-2026-3318)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3318 advisory. A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute...

Important: dnsmasq

Issue Overview: A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet. CVE-2026-4892 An information disclosure vulnerability in dnsmasq allows remote attackers to...