memguard

MemGuard 민감한 정보를 메모리에 안전하게 저장하기 위한 소프트웨어 엔클레이브Enclave입니다. 이 패키지는 메모리 내에서 민감한 데이터가 노출될 가능성을 줄이기 위해 설계되었습니다. 모든 주요 운영체제를 지원하며 순수 Go로 작성되었습니다. 특징 민감한 데이터는 XSalsa20Poly1305로 암호화 및 인증되어 메모리에 저장됩니다. 사용된 방식은 콜드 부트 공격Cold-boot attack 방어도 제공합니다. 메모리 할당은 시스템 호출System call을 사용하여 커널에 직접 리소스를 요청함으로써 언어 런타임을...

AceLdr

AceLdr - 메모리 스캐너 회피 Cobalt Strike를 위한 위치 독립적 리플렉티브 로더입니다. Hunt-Sleeping-Beacons, BeaconHunter, BeaconEye, Patriot, Moneta, PE-sieve, MalMemDetect에서 0건의 결과를 반환합니다. 기능 사용하기 쉬움 쉘코드를 생성하기 전에 단일 CNA 스크립트를 가져오세요. 동적 메모리 암호화 Beacon에서 할당된 모든 항목에 대해 새 힙을 생성하고 절전 전에 항목을 암호화합니다. 코드 난독화 및 암호화 CS 실행 코드를 포함하는...

patriot

Patriot Small research project for detecting various kinds of in-memory stealth techniques. Download the latest release here. The current version supports the following detections: Suspicious CONTEXT structures pointing to VirtualProtect functions. Targets research by Austin Hudson Foliage and Ek...

NimShellcodeFluctuation

NimShellcodeFluctuation 元のリポジトリのNim移植版： https://github.com/mgeeky/ShellcodeFluctuation すべてのコメントは、元のリポジトリからそのままコピー＆ペーストしました。このテクニックを理解するのに非常に役立ったからです。このテクニック自体の詳細については、元のリポジトリのREADMEを読むことを強くお勧めします！ 依存関係のインストール： nimble install winim ptrmath...

SleepyCrypt

SleepyCrypt スリープ時にメモリ内の実行中プロセスイメージを暗号化するシェルコード関数です。 これは私のブログ記事こちらの関連コードです。 ビルド build.sh を実行するだけで、C コードをコンパイルし、.text セクションをシェルコードとして抽出し、sleep.exe というテスト用バイナリにコンパイルします。これには Linux 上の MinGW（x8664-w64-mingw32-gcc、x8664-w64-mingw32-ld、objcopy）が必要です。...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus – Do not free ring buffers that cannot be re-encrypted. In CoCo VMs, it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail, resulting in an error and the return of...

CVE-2026-4932

IBM PowerVM Hypervisor vulnerability CVE-2026-4932 affects FW1110.00–FW1110.20 and FW1060.00–FW1060.71. Affects PowerVM Hypervisor and TME hardware; attacker with physical access to Transparent Memory Encryption could decrypt memory due to insufficient cryptographic entropy. Impact is high confid...

CVE-2026-4932

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker with physical access to the Transparent Memory Encryption TME hardware to decrypt encrypted memory due to insufficient cryptographic entropy...

Security Bulletin: This Power System update is being released to address CVE-2026-4932

Summary A firmware issue was identified where the generated AES key used to initialize the Transparent Memory Encryption TME hardware has weakened encryption strength. Vulnerability Details CVEID:CVE-2026-4932 DESCRIPTION: PowerVM Hypervisor could allow an attacker with physical access to the...

SUSE CVE-2026-64104

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...

CVE-2026-64104

A flaw was found in the Linux kernel's SEV-ES Secure Encrypted Virtualization-Encrypted State guest module. When memory encryption or decryption operations fail, the affected memory pages can be left in an unknown or unencrypted state. This could lead to information disclosure, as these pages are...

CVE-2026-64104

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...

CVE-2026-64104 virt: sev-guest: Explicitly leak pages in unknown state

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...

CVE-2026-64104

CVE-2026-64104 (Linux kernel) affects virt: sev-guest where set_memory_encrypted()/set_memory_decrypted() can fail leaving pages in an unknown state, potentially unencrypted and not safely returnable to the buddy allocator. The provided documentation notes that to avoid this, the pages should not...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Signal: Fix for restoring SVE context When SME is supported, restoring the SVE signal context can fail in several ways. This can result in the task being placed in an invalid state, where the kernel might read from...

PT-2026-61421

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sev-guest component of the virt subsystem. When the set memory encrypted or set memory decrypted functions fail, the caller cannot determine the exact point of...

Linux Distros Unpatched Vulnerability : CVE-2026-31592

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Protect all of sevmemencregisterregion with kvm-lock Take and hold kvm-lock for before checking sevguest in sevmemencregisterregion, as sevguest isn't...

KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION

...

SUSE CVE-2026-31590

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Drop WARN on large size for KVMMEMORYENCRYPTREGREGION Drop the WARN in sevpinmemory on npages overflowing an int, as the WARN is comically trivially to trigger from userspace, e.g. by doing: struct kvmencregion range =...

AZL-83654 CVE-2026-31590 affecting package kernel for versions less than 6.6.137.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Drop WARN on large size for KVMMEMORYENCRYPTREGREGION Drop the WARN in sevpinmemory on npages overflowing an int, as the WARN is comically trivially to trigger from userspace, e.g. by doing: struct kvmencregion range =...