Intel-CVE-2015-2291

Intel-CVE-2015-2291 CVE-2015-2291 的 PoC 漏洞利用 利用存在漏洞的 Intel 驱动程序，通过纯数据攻击获取系统 shell。 该代码本身实现了驱动程序提供的更多“功能”，例如物理地址到虚拟地址的转换、物理内存映射（这两者结合 = 任意内核内存覆写），因此可用于在内核中执行任意代码。...

ios-malicious-bithunter

iOS恶意位猎手 摘要 iOS恶意位猎手是一个针对iOS应用的恶意插件检测引擎。它能够基于运行时分析注入的dylib动态库的macho文件头部，并通过接口输入特性进行行为分析，以判断动态库特征的行为。该程序不依赖越狱环境，可在AppStore上使用。 新特性 这是一种精确识别iOS恶意代码行为的新方法。基于对App中Mach-O格式的内存中恶意代码运行的分析方法，它可以执行灵活的行为识别以进行分析和持续跟踪。这是一种非常准确的防插件防御方法，包括行为、变量及高度混淆的代码（包括ollvm），在我们的防御过程中取得了非常好的效果。 使用方法 1...

asus-bsitf-0-day-poc

POC - ASUS bsitf.sys 内核内存映射到用户态 CVE-2026-13585 摘要 ASUS bsitf.sys（也以 AsusBSItf.sys 形式分发）内核驱动暴露了 IOCTL 0x222808，该 IOCTL 分配攻击者控制大小的物理连续内核内存，将其映射到调用进程的地址空间并赋予完全读写权限，同时返回用户态虚拟地址和物理地址给调用者。 该设备需要管理员权限才能打开，这使得这是一个从管理员到内核的提权。在...

LdrLibraryEx

LdrLibraryEx 一个用于将 dll 加载到内存中的小型 x64 库。 特性 低依赖性与低函数使用（仅使用 ntdll.dll） 位置无关代码 轻量且精简 易于使用 从内存加载模块 从磁盘加载模块 支持 API Sets 绕过映像加载回调（通过私有内存） 支持具有延迟导入、tls、seh 等的映像 文档 库标志 标志可以组合使用 LIBRARYEXNONE：从磁盘将模块映射到内存并执行入口点。 LIBRARYEXBYPASSLOADCALLBACK：从磁盘将模块映射到私有内存（无后备），从而绕过映像加载回调（PsSetLoadImageNotifyRoutine）...

MemoryMapper

内存映射器 内存映射器是一个轻量级库，允许通过用户指定的进程注入或自注入（将程序集注入当前尝试注入的进程）的方式，将原生和托管程序集映射到内存中。该库不仅提供映射程序集的工具，还具备加密、解密和生成各种加密强度数据的能力。 需求 注意: （仅适用于使用内存映射器的运行程序集——不适用于存根/Shellcode） Windows 7 SP1 及更高版本 .NET Framework 4.6.1 功能 探索PE（可移植可执行文件）的结构 从托管和原生程序集中读取资源 使用进程注入和自注入将原生程序集映射到内存 使用进程注入和其他技术将托管程序集映射到内存 获取任意大小文件的字节数组...

CVE-2026-47491

A flaw was found in nvidia-driver. A local unprivileged attacker can trigger the improper release of memory resources in the kernel mode layer, leaving a memory mapping accessible after the underlying memory is reused. A successful exploit could allow an attacker to achieve privilege escalation,...

CVE-2026-102820

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied...

Lumma-Stealer-dllhost-Hollowing-C2-Domains-Payload-Extraction-Analysis

1. Setup.exe – 隐私、驱动与内存字符串 对 setup.exe 投放器的 Process Hacker 内存分析显示，Lumma Stealer 针对隐私设置、安装驱动程序并管理内存。 观察到的关键字符串： Privacy Camera – 尝试访问或禁用摄像头隐私设置。 Privacy Microphone – 尝试访问或禁用麦克风隐私设置。 PreinstallDriver – 表明为持久化或规避而安装驱动程序。 MapMemoryB0000 – 内存映射操作（可能用于注入）。 为何重要： 隐私绕过： 该恶意软件可能禁用摄像头/麦克风隐私设置。 驱动程序安装：...

Eneio64-LPE

打开到易受攻击驱动的句柄 2. 将物理内存映射到用户空间 3. 打开到系统进程的句柄 4. 查询当前进程的 SystemHandleInformation 表，以获取泄露其 EPROCESS 地址的系统句柄。 5. 遍历系统 EPROCESS 的 ActiveProcessLinks 向前链（flink），直到找到当前进程的 PID。 6. 将当前进程的令牌替换为系统进程的令牌 7. 生成一个新的 PowerShell 进程。 使用 Superfetch 方法进行虚拟到物理地址转换，而非泄露 CR3 并遍历页表。 已在 Win11 21H2 上测试...

CVE-2026-29923

CVE-2026-29923 - 通过任意物理内存映射实现本地权限提升 pstrip64.sys 内核驱动程序暴露了一个 IOCTL，允许低权限用户将任意范围的物理内存映射到自己的虚拟地址空间中。该原语允许对系统物理 RAM 进行完全读写访问，使攻击者能够修改关键的内核结构并将权限提升至 NT AUTHORITY\SYSTEM。 该驱动程序创建了设备对象 \Device\PSTRIP64 和符号链接 \DosDevices\PSTRIP64，可供用户访问。 该漏洞存在于 DispatchDeviceControl 例程中，具体是 IOCTL 0x80002008 的处理程序。函数...

CVE-2026-98140

A flaw was found in the Linux kernel's NTFS file system. A local user could trigger this vulnerability during error handling in Master File Table MFT write operations, where temporary kernel memory mappings fail to be released properly. Because these local memory mappings require strict ordering,...

CVE-2026-97931 ALSA: us122l: Prevent write upgrades for read mappings

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...

CVE-2026-97912: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM size is 0 on mapping failure On a mapping failure of the SRAM, the SRAM size is left as non-zero. The probe will succeed as the error return is not checked since having SRAM is not a hard requirement. T...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: TCP: fixed page frag corruption upon a page fault. Steffen reported a corruption of the TCP stream for HTTP requests served by the Apache web-server, using a CIFS mount-point and the corresponding file’s memory mapping. The root...

Astra Linux – Vulnerability in Linux 5.10, Linux

Guests running on Arm can cause Denial of Service DoS attacks on Dom0 through PV devices. When mapping memory pages of guests on Arm, Dom0 uses an rbtree to keep track of the foreign mappings. The update of this rbtree does not always occur completely with the relevant lock held, resulting in a...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: crypto: qat – fix DMA transfer direction When CONFIGDMAAPIDEBUG is enabled, during the execution of the crypto self-test for QAT crypto algorithms, the function adddmaentry reports a warning indicating that overlapping mapping...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the virtual address and size of the userq buffer. It is necessary to validate the virtual address of the userq object to determine whether it is located in a valid vm mapping...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: fixed the possible null dereference of cp The cp parameter may be null. Calling cp-cpconn would result in a null dereference. Simon Horman adds: Analysis: cp is a parameter of rdsrdmamap, and it is not reassigned. The...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ACPI: Tables: FPDT: Do not call acpiosmapmemory on an invalid physical address. On a Packard Bell Dot SC Intel Atom N2600 model, there is an FPDT table containing invalid physical addresses, with high bits set that fall outside t...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Since commit a4d5613c4dc6 “arm: extend pfnvalid to take into account freed memory map alignment” changes the semantics of pfnvalid to check the presence ...