memguard

MemGuard Software enclave for storage of sensitive information in memory. This package attempts to reduce the likelihood of sensitive data being exposed when in memory. It aims to support all major operating systems and is written in pure Go. Features Sensitive data is encrypted and authenticated...

ifuncd-up

In Response to Hacker News I see you jokers on the orange website are giving me a hard time. I will make a few choice responses below, but first I offer a challenge: I will send $500 of my own money to the first person who can demonstrate this attack without ifunc. I am genuinely interested, and...

ShellcodeFluctuation

Shellcode Fluctuation PoC Una implementación de prueba de concepto para otra técnica de evasión en memoria que cifra y descifra cíclicamente el contenido del shellcode para luego hacerlo fluctuar entre la protección de memoria RW o NoAccess y RX. Cuando nuestro shellcode reside en páginas de...

NovaHypervisor

NovaHypervisor Description NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks either via Bring Your Own Vulnerable Driver BYOVD or other means by safeguarding defense products AntiVirus / Endpoint Protection and kerne...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis

1. API nativa e inyección APC El volcado de memoria de x64dbg revela que Agent Tesla usa llamadas a la API nativa NT API para operaciones de bajo nivel, incluida la inyección APC llamada a procedimiento asíncrono. Funciones clave observadas: NtQueueApcThread – Inyecta código en un hilo de destino...

cve-writeups-and-pocs

CVE-2026-80724 PoC y Write-up CVE-2026-80724 — Kernel de Linux ptp: vmclock: evitar que los mapeos de solo lectura se vuelvan escribibles Prueba de concepto completa + Write-up técnico Investigación de seguridad por Abdifatah Suruur suruur — colección de write-ups de CVE y PoCs para...

HeapCrypt

HeapCrypt Cifrando el Heap mientras se duerme, enganchando y modificando Sleep con nuestra propia función que cifra el heap, se duerme un momento y luego descifra el heap: Cifrado xor del heap con clave de 16 bits : Descifrado xor del heap con clave de 16 bits : Referencias :...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: The risk of out-of-memory access has been prevented. The dvbdev module contains a static variable used to store dvb minors. Its behavior depends on whether CONFIGDVBDYNAMICMINORS is set or not. When it is not set,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: KVM: x86: Added SRCU protection for reading PDPTRs in getsregs2. Added read-side protection when reading PDPTR registers in getsregs2. Reading PDPTRs may trigger access to guest memory: kvmpdptrread - svmcachereg - loadpdptrs ...

Astra Linux – Vulnerability in amd64-microcode

IOMMU improperly handles certain special address ranges with invalid device table entries DTEs. This may allow an attacker with privileges and a compromised Hypervisor to induce DTE faults to bypass RMP checks in SEV-SNP, potentially resulting in a loss of guest integrity...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Consider the return from setmemoryro when using bpfproglockro setmemoryro may fail, leaving memory unprotected. Consider this return value as an error...

USN-8726-1 linux, linux-aws, linux-aws-7.0, linux-gcp, linux-gke, linux-hwe-7.0, linux-realtime vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

CVE-2026-72279

A flaw was found in the KVM Kernel-based Virtual Machine component of the Linux kernel. KVM on arm64 architectures incorrectly maps the L1 Virtual Nested Control Register VNCR into the host stage-1, failing to respect read-only memory regions. This could allow a malicious guest to write to a...

CVE-2026-72155 mtd: spi-nor: swp: Improve locking user experience

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience In the case of the first block being locked or the few first blocks, if the user want to fully unlock the device it has two possibilities: - either it asks to unlock the entire...

CVE-2025-31936

Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processors when using IntelR TDX within SMM may allow an escalation of privilege. SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may...

EUVD-2026-55356

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

SUSE-SU-2026:3166-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. - CVE-2025-71302: drm/panthor: fix for dma-fence safe access...

CVE-2026-63830

A flaw was found in the Linux kernel's skmsg networking component. This vulnerability arises when the sg.copy bitmap, which controls memory access permissions, is not properly maintained during data transformations. This can allow a local attacker to bypass memory protection mechanisms, enabling...

SUSE-SU-2026:22755-1 Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...