windows-api-function-cheatsheets

Hoja de referencia de funciones de la API de Windows Contacto 🌨️ Snowcrash: [email protected] Tabla de contenidos Hoja de referencia de funciones de la API de Windows Operaciones de archivos Gestión de procesos Gestión de memoria Gestión de hilos Gestión de bibliotecas de vínculos dinámicos...

CVE-2018-17182

CVE-2018-17182 Linux 内核VMA-UAF 提权漏洞（CVE-2018-17182） About Google Project Zero的网络安全研究人员发布了详细信息，并针对自内核版本3.16到4.18.8以来Linux内核中存在的高严重性漏洞的概念验证（PoC）漏洞利用。 由白帽黑客Jann Horn发现，内核漏洞（CVE-2018-17182）是Linux内存管理子系统中的缓存失效错误，导致释放后使用漏洞， 如果被利用，可能允许攻击者获得root权限目标系统上的特权...

page_table_walk

物理内存中的夺旗挑战 你已经读过关于分页的内容。图表看起来也合理。四级页表，每级9位，页框，偏移量。没错。但当你遇到一个真正需要手动遍历页表的挑战时，你意识到你并不真正理解它。你只是知道它。区别很大。 对我来说有效的方法是坐在QEMU和gdb前，亲自手动完成遍历：计算每个索引，从物理内存中读取每个条目，手动跟踪每个指针。一个下午的实践比几个小时的讲座学到更多。 这是我当时记录的笔记集合。如果你仍然缺少概念方面的理解，先看Zardus的关于内核内存管理的讲座。那是理论。这是实践。...

StackRot

StackRot CVE-2023-3269: Linux 内核权限提升漏洞 GitHub-CI-verified exploit 在 Linux 内核 6.1 至 6.4 版本的堆栈扩展处理中发现了一个漏洞，俗称“Stack Rot”。负责管理虚拟内存区域的 maple 树在节点替换时未能正确获取 MM 写锁，从而导致释放后使用（use-after-free）问题。低权限的本地用户可利用此漏洞危害内核并提升权限。 由于 StackRot 是内存管理子系统中的 Linux 内核漏洞，它几乎影响所有内核配置，且触发所需权限极低。但需要注意的是，maple 节点通过 RCU...

CVE-2026-20637-AppleSEPKeyStore-UAF

CVE-2026-20637: AppleSEPKeyStore Use-After-Free CVE-2026-20637 | Author: Johnny Franks @zeroxjf Component: AppleKeyStore Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. —Apple Security Content, iO...

salt

欢迎使用 salt ，一个用于逆向和学习内核堆内存管理的工具。它可用于开发漏洞利用、调试自己的内核代码，更重要的是，用于操作内核堆分配并学习其内部机制。 该工具有助于跟踪现代 Linux 内核中 SLUB 分配器的分配情况和当前状态。 它作为 gdb 插件编写，允许您跟踪 和记录 内存分配，并按进程名称或缓存过滤 。该工具还可以转储活动缓存列表并打印相关信息。 该仓库还包含一个 游乐场 可加载内核模块，可以随心所欲地触发分配和释放，既可作为调试工具，也可作为学习工具，帮助更好地理解分配器的工作原理。 有关 SLUB 分配器内部机制、如何开始、插件的详细文档 以及 游乐场模块说明...

CVE-2026-102004

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09...

EUVD-2026-88467

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09...

CVE-2026-102004

Wind River VxWorks 7 versions prior to 26.09 are vulnerable to a memory corruption flaw within the memory management subsystem . The vulnerability is triggered by providing specific arguments to certain system calls . This issue can lead to high impacts on confidentiality, integrity, and availabi...

CVE-2026-102004 VxWorks 7

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09...

CVE-2026-97525

A flaw was found in the Linux kernel. When the memory management subsystem splits large memory pages on x86 architectures, it allocates page tables without properly registering them as kernel page tables. As a result, the kernel fails to invalidate associated translation entries in the I/O...

CVE-2026-23416-POC

CVE-2026-23416 — PoC mm/mseal: 合并时正确更新 VMA 结束地址 漏洞发现者：Antonius / Blue Dragon Security 概述 字段| 详情 ---|--- CVE ID| CVE-2026-23416 子系统| mm/mseal — mm/vma.c 影响范围| Linux 内核 6.17 至 7.0-rc5 修复版本| Linux 7.0-rc6，稳定版回溯 6.18.21、6.19.11 所需权限| 非特权用户（UID 1000，无 capabilities） 使用的系统调用| memfdcreate、mmap、mseal 可复现性...

linux-insides

linux-insides A book-in-progress about the Linux kernel and its insides. Introduction • Chapter status • Requirements • Translations • Contributing • Author Introduction linux-insides is a book-in-progress about the Linux kernel and its insides. The goal of this project is simple - to share...

CVE-2026-97605

In the Linux kernel, the following vulnerability has been resolved: erofs: preserve LZMA decoders on resize failure The pool-resize path frees each stream's old decoder before allocating its replacement. If an allocation fails after some streams have already been replaced, the failed stream is pu...

CVE-2026-97585

In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afseditdirremove to use a cleanup function to unmap the block pointed to by afsdiriter::block if it's left pointing to something rather than manually kunmapping the blocks. Manually...

CVE-2026-98119

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...

CVE-2026-98024

A vulnerability exists in the Linux kernel (s390/ism) where the ism_alloc_dmb() function incorrectly used kfree() instead of folio_put() during an error exit for memory allocated via folio_alloc(). This flaw could lead to slab allocator corruption . The fix involves using folio_put() and resettin...

CVE-2026-97605

The Linux kernel contains a vulnerability in the erofs filesystem involving the pool-resize path for LZMA decoders . The root cause is that the system frees old decoders before successfully allocating replacements; if an allocation fails mid-process, the failed stream is returned to the list with...

CVE-2026-97605 erofs: preserve LZMA decoders on resize failure

In the Linux kernel, the following vulnerability has been resolved: erofs: preserve LZMA decoders on resize failure The pool-resize path frees each stream's old decoder before allocating its replacement. If an allocation fails after some streams have already been replaced, the failed stream is pu...

EUVD-2026-86882

In the Linux kernel, the following vulnerability has been resolved: bnxten: Don't free the live ring's TPA state on queue restart failure bnxtqueuememalloc shallow copies the live RX ring into the clone: memcpyclone, rxr, sizeofrxr; the code currently clears pointers that the clone owns such as...