CVE-2021-21551

CVE-2021-21551 CVE-2021-21551에 대한 개념 증명 익스플로잇입니다. 이 취약점은 사용자 제공 주소가 memmove 호출의 인수로 전달되어 임의 읽기/쓰기를 가능하게 하는 것ioctls 0x9B0C1EC4 및 0x9B0C1EC8과, MmMapIoSpace 호출의 물리적 주소 매개변수가 또 다른 임의 읽기/쓰기를 제공하는 것ioctls 0x9B0C1F40 및 0x9B0C1F44에서 발생합니다...

CVE-2024-26160

CVE-2024-26160 cldflt.sys 정보 공개 취약점 CVE-2024-26160 에 대한 간단한 분석 글입니다. 이 취약점은 2월 패치KB5034765 , Windows 11 22H2, Windows 11 23H2에서 발견할 수 있으며, 3월 패치KB5035853에서 수정되었습니다. 분석 취약점은 CldiPortProcessGetRangeInfo 함수에 있으며, 사용자 애플리케이션에서 전달된 버퍼 크기를 확인하지 않습니다. 크기는 사용자가 제어할 수 있으므로, 반환된 정보를 복사하는 memmove가 크기가 올바르게...

ABL_ROP

Updating ABL serial with ROP: When ran this notebook will load ABL and attempt to update the device's serial number via ROP chain to call memmove. Derived from eShard's https://github.com/eshard/pixel6-boot/blob/main/runablpublic.ipynb whilst following along with...

cve-2024-46483

CVE-2024-46483 - Xlight SFTP 서버의 인증 전 힙 오버플로우 영향을 받는 버전 Xlight 32비트 및 64비트 버전 = 3.9.4.2 영향 인증되지 않은 공격자가 Xlight SFTP에 접근하여 코드 실행을 달성하거나 서비스 거부 또는 서비스를 유발할 수 있습니다. 근본 원인 SFTP 프로토콜에서 전송되는 문자열은 4바이트 길이 접두사가 붙습니다. Xlight가 네트워크 패킷에서 이러한 문자열을 읽는 데 사용하는 함수는 길이를 검증하고 필요한 메모리 양을 할당할 때 정수 오버플로우가 발생합니다. 문자열에...

CVE-2023-52356-libtiff-analysis

CVE-2023-52356 – libtiff TIFFReadRGBATileExt 분석 개요 이 실습은 libtiff의 CVE-2023-52356을 분석하며, TIFFReadRGBATileExt가 유효한 이미지 경계를 벗어난 이미지 좌표를 수신할 때의 동작에 초점을 맞춥니다. 이 분석에는 원본 크래시 재현, AddressSanitizer 및 GDB를 사용한 디버깅, 근본 원인 분석, 업스트림 패치 검토, 원본 리프로듀서 분석, 수정 버전 검증이 포함됩니다. 테스트 환경 대상: libtiff 취약 커밋: 4d0329a4 수정 커밋...

CVE-2025-62821

Microsoft HEIF Image Extensions msheifstore.dll: CopyPixels 경로에서 소스 버퍼 미할당으로 인한 범위 초과 읽기 및 액세스 위반 DoS WIC를 통해 조작된 HEIF 이미지를 디코딩할 때, msheif 코덱은 1바이트 소스 버퍼를 할당하지만 이후 CopyPixels 중에 해당 버퍼에서 매우 많은 양의 픽셀 데이터를 복사하려고 시도합니다. 복사는 stride × ROI 높이에서 파생된 크기로 memmove를 사용하며, 소스 버퍼의 실제 길이를 검증하지 않습니다. 이로 인해 범위 초과...

freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 FreeBSD のexecargsadjustargs の OOB memmove によるローカル権限昇格 execargsadjustargs（sys/kern/kernexec.c、2013年から存在）の演算子優先順位のバグにより、sshd が動作しているデフォルトの FreeBSD インストールでは、任意のローカルユーザーが root に権限昇格できます。suid...

Rocky Linux 8 [CIQ] Security Update: lz4 / lz4-debuginfo / lz4-debugsource / lz4-devel / lz4-libs / etc (crlsa-2021_2575)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212575 advisory. lz4: memory corruption due to an integer overflow bug caused by memmove argument CVE-2021-3520 Tenable has extracted the preceding description block directly from t...

ANT-2026-QT406EDT · LibreOffice/core · Memory corruption (heap buffer overflow)

other medium CVE-2026-63274 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-QT406EDT: Heap overflow from unclamped /Length...

SUSE CVE-2026-89493

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...

CVE-2026-19499

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding...

CVE-2026-19499 Buffer overflow in strfmon and strfmon_l right-justification padding

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding...

CVE-2026-19499 Buffer overflow in strfmon and strfmon_l right-justification padding

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “vt: fix unicode buffer corruption when deleting characters” This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 “vt: fix memory overlapping when deleting chars in the buffer”. The solution is als...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can cause an integer overflow in the memmove function, resulting in a heap-based buffer overflow in the ntfsattrrecordresize function, as of NTFS-3G version 2021.8.22...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105tabledeleteentry There are actually 2 problems: 1. Deleting the last element does not require moving elements. In fact, the element at position i+1 is out of bounds. 2...

Astra Linux – Vulnerability in lz4

There is a flaw in lz4. An attacker who submits a crafted file to an application that uses lz4 may be able to trigger an integer overflow, resulting in the call to memmove with a negative size argument. This can lead to an out-of-bounds write and/or a system crash. The most significant impact of...

Astra Linux – Vulnerability in liblivemedia

In Live555 0.95, there is a buffer overflow due to a large integer in the Content-Length HTTP header. This occurs because the handleRequestBytes function uses a memmove operation without proper bounds...

SUSE CVE-2026-89542

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long, and its rotateleft helper pass...

SUSE CVE-2026-89617

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIRPAGEENTRY ends in a pagelcns array whose length is the on-disk lcnsfollow field. checkrstbl validates the table bookkeeping but never checks that this array fits in the...