CVE-2016-5195

デモ1 このデモは https://github.com/timwr/CVE-2016-5195 に基づいています。 make test の出力: root@kitploit: user@user:/$ cd /home/user/demo1 && make test /home/user/adb/android-ndk-r21d/ndk-build NDKPROJECTPATH=. APPBUILDSCRIPT=./Android.mk APPABI=x8664 APPPLATFORM=android-23 make1: Entering directory...

cve-2018-17182

define GNUSOURCE include include include include include include include include include include include int vmaspamcontrolfd = -1; int threaddonefd = -1; int vmaspamdonefd = -1; void semincint fd uint64t val = 1; if writefd, &val, 8 != 8 err1, "seminc"; void semdecint fd uint64t val; if readfd,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed the issue where the mmap write lock was not released. If the mmap write lock is acquired while draining a retry fault, the mmap write lock is not released because svmrangerestorepages calls mmapreadunlock before...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fixed AUX buffer serialization. Ole reported that the event-mmapmutex is strictly insufficient to serialize the AUX buffer. To serialize it properly, a per-RB mutex should be added...

CVE-2021-28663

CVE-2021-28663 CVE-2021-28663 の基本的な PoC リーク Android カーネルバックドア脆弱性の内部 これは CVE-2021-28663 の基本的な PoC です。Mali GPU Android カーネルドライバの設計上の欠陥です。 1. GPUVA を作成し、それに mmap も行うことで、物理ページの仮想アドレスを取得できるようにします。 2. 物理ページのエイリアスを作成しますが、mmap は行わないため、gpumapping は 1 のままです。 3. GPUVA のフラグを BASEMEMDONTNEED に変更します。Mali はそれらを...

CVE-2016-5195-master

CVE-2016-5195 CVE-2016-5195 dirty cow/dirtycow/dirtyc0w Android向けの概念実証 このリポジトリは、ADBで接続された脆弱性のあるAndroidデバイス上で脆弱性を実証します。 SELinuxを無効にしたり（https://github.com/timwr/CVE-2016-5195/issues/9 を参照）、デバイスにsuperuserをインストールしたりしません。 root@kitploit: $ make root ndk-build NDKPROJECTPATH=. APPBUILDSCRIPT=./Android.m...

CVE-2024-44947

CVE-2024-44947 説明 : Linux カーネルにおいて、以下の脆弱性が修正されました: fuse: ファイル終端を超えるページの内容を初期化してから uptodate に設定する fusenotifystore は、fusedoreadpage とは異なり、ページのゼロ化を有効にしません（部分的なページ内容の変更に使用できるため）。そのため、fusenotifystore は、ページを uptodate...

CVE-2026-89772

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

EUVD-2026-76684

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-89772

CVE-2026-89772 affects the btrfs filesystem in the Linux kernel . A patch (commit 095be159f3eb) replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check, losing the write-protection of shared mmap PTEs during data writeback. Without this pro...

CVE-2026-89772 btrfs: write-protect folios during data writeback

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

CVE-2026-89772 btrfs: write-protect folios during data writeback

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the foliocleardirtyforio call in extentwritecachepages with a plain foliotestdirty check. Besides clearing th...

PT-2026-90488

In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folios during data writeback commit 095be159f3eb "btrfs: unify folio dirty flag clearing" replaced the folio clear dirty for io call in extent write cache pages with a plain folio test dirty check. Besides...

Dirty-COW-CVE-2016-5195-

Dirtyc0w Docker POC 前提条件: Vagrant がインストールされていること 使い方 まずプロジェクトをクローンします git clone https://github.com/BrolyCode/Dirty-Cow.git フォルダーに入ります cd Dirty-Cow 次に、以下のコマンドで環境を起動します root@kitploit: vagrant up サーバーが構築されたら、SSH で接続します root@kitploit: vagrant ssh root ユーザーに切り替えます root@kitploit: sudo -i...

dyen

dyen dyen 使用 macOS 自带的 Python 在内存中加载 Mach-O dylib，并在不调用 dlopen 的情况下调用该 dylib 的导出入口点。其目标是使映像永远不会以独立文件的形式出现在目标上，也永远不会注册到 dyld。 作者：cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/dyen Summary dyen 是一个仅使用标准库的 Mach-O 内存加载器（loader.py），适用于 macOS 上自带的 /usr/bin/python3。它读取普通...

android-CVE-2016-5195

CVE-2016-5195 CVE-2016-5195（dirty cow/dirtycow/dirtyc0w）针对 Android 的概念验证 此仓库演示了通过 ADB 连接的存在漏洞的 Android 设备上的该漏洞。 它不会禁用 SELinux（参见 https://github.com/timwr/CVE-2016-5195/issues/9），也不会在设备上安装超级用户。 root@kitploit: $ make root ndk-build NDKPROJECTPATH=. APPBUILDSCRIPT=./Android.mk APPPLATFORM=android-16...

kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap

A flaw was found in the Linux kernel's accel/qaic driver. This vulnerability allows for memory to be mapped beyond its intended boundaries during certain memory allocation operations. A local attacker could exploit this flaw, leading to a use-after-free condition. This could potentially result in...

Linux Distros Unpatched Vulnerability : CVE-2026-80867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - alpha/PCI: Add securitylockeddown check to pcimmapresource Currently, Alpha's pcimmapresource does not check securitylockeddownLOCKDOWNPCIACCESS before allowing...

SUSE CVE-2026-80867

In the Linux kernel, the following vulnerability has been resolved: alpha/PCI: Add securitylockeddown check to pcimmapresource Currently, Alpha's pcimmapresource does not check securitylockeddownLOCKDOWNPCIACCESS before allowing userspace to mmap PCI BARs. The generic version has had this check...

CVE-2026-80867

In the Linux kernel, the following vulnerability has been resolved: alpha/PCI: Add securitylockeddown check to pcimmapresource Currently, Alpha's pcimmapresource does not check securitylockeddownLOCKDOWNPCIACCESS before allowing userspace to mmap PCI BARs. The generic version has had this check...