CVE-2021-28663

CVE-2021-28663 CVE-2021-28663 の基本的な PoC リーク Android カーネルバックドア脆弱性の内部 これは CVE-2021-28663 の基本的な PoC です。Mali GPU Android カーネルドライバの設計上の欠陥です。 1. GPUVA を作成し、それに mmap も行うことで、物理ページの仮想アドレスを取得できるようにします。 2. 物理ページのエイリアスを作成しますが、mmap は行わないため、gpumapping は 1 のままです。 3. GPUVA のフラグを BASEMEMDONTNEED に変更します。Mali はそれらを...

CVE-2024-44947

CVE-2024-44947 説明 : Linux カーネルにおいて、以下の脆弱性が修正されました: fuse: ファイル終端を超えるページの内容を初期化してから uptodate に設定する fusenotifystore は、fusedoreadpage とは異なり、ページのゼロ化を有効にしません（部分的なページ内容の変更に使用できるため）。そのため、fusenotifystore は、ページを uptodate...

dyen

dyen dyen 使用 macOS 自带的 Python 在内存中加载 Mach-O dylib，并在不调用 dlopen 的情况下调用该 dylib 的导出入口点。其目标是使映像永远不会以独立文件的形式出现在目标上，也永远不会注册到 dyld。 作者：cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/dyen Summary dyen 是一个仅使用标准库的 Mach-O 内存加载器（loader.py），适用于 macOS 上自带的 /usr/bin/python3。它读取普通...

Dirty-COW-CVE-2016-5195-

Dirtyc0w Docker POC Requisitos previos: Vagrant instalado Cómo usar Primero clona el proyecto git clone https://github.com/BrolyCode/Dirty-Cow.git Entra en la carpeta cd Dirty-Cow Luego levanta el entorno con el comando vagrant up Una vez que el servidor esté construido, nos conectaremos por ssh...

android-CVE-2016-5195

CVE-2016-5195 CVE-2016-5195 dirty cow/dirtycow/dirtyc0w Android向け概念実証 このリポジトリは、ADB経由で接続された脆弱性のあるAndroidデバイス上で本脆弱性を実証します。SELinuxを無効化したり（https://github.com/timwr/CVE-2016-5195/issues/9 参照）、デバイスにスーパーユーザーをインストールしたりはしません。 $ make root ndk-build NDKPROJECTPATH=. APPBUILDSCRIPT=./Android.mk...

AZL-106146 CVE-2026-98216 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...

CVE-2026-98216

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...

CVE-2026-98216

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...

CVE-2026-98216 IB/hfi1: Fix the PIO_CRED credit-return mmap

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...

EUVD-2026-93143

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve user SID across nested backing files SELinux saves the user file SID in a backing-file security blob so it remains available after mmap replaces vma-vmfile with a backing file. For nested backing files overlayfs...

CVE-2026-98215 selinux: preserve user SID across nested backing files

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve user SID across nested backing files SELinux saves the user file SID in a backing-file security blob so it remains available after mmap replaces vma-vmfile with a backing file. For nested backing files overlayfs...

CVE-2026-98214

A vulnerability in the Linux kernel allows the mprotect() system call to bypass SELinux checks performed by mmap() against intermediate layers of a stacked filesystem . While mmap() validates every backing layer in the stack, mprotect() only references the lowest backing file, skipping intermedia...

EUVD-2026-93142

In the Linux kernel, the following vulnerability has been resolved: selinux: recheck intermediate backing files on mprotect mprotect can be used to bypass the SELinux checks that mmap performs against the intermediate layers of a stacked filesystem. mmap checks every backing layer as the request...

Linux Distros Unpatched Vulnerability : CVE-2026-98214

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: recheck intermediate backing files on mprotect mprotect can be used to bypass the SELinux checks that mmap performs against the intermediate layers of ...

PT-2026-106553

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmap prepare failure mmap setup accounts memory for relevant mappings via: security vm enough memory mm - vm enough memory - vm acct memory If mmap setup fails, this indicates that this accounting d...

CVE-2026-98214: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: selinux: recheck intermediate backing files on mprotect mprotect can be used to bypass the SELinux checks that mmap performs against the intermediate layers of a stacked filesystem. mmap checks every backing layer as the request...

PT-2026-106545

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hfi1 file mmap function within the IB/hfi1 driver regarding the PIO CRED credit-return memory mapping. The implementation contains two primary errors: first, it...

PT-2026-106543

In the Linux kernel, the following vulnerability has been resolved: selinux: recheck intermediate backing files on mprotect mprotect can be used to bypass the SELinux checks that mmap performs against the intermediate layers of a stacked filesystem. mmap checks every backing layer as the request...

cve-2018-17182

define GNUSOURCE include include include include include include include include include include include int vmaspamcontrolfd = -1; int threaddonefd = -1; int vmaspamdonefd = -1; void semincint fd uint64t val = 1; if writefd, &val, 8 != 8 err1, "seminc"; void semdecint fd uint64t val; if readfd,...

CVE-2016-5195

demo1 此演示基于 https://github.com/timwr/CVE-2016-5195 make test 输出： user@user:/$ cd /home/user/demo1 && make test /home/user/adb/android-ndk-r21d/ndk-build NDKPROJECTPATH=. APPBUILDSCRIPT=./Android.mk APPABI=x8664 APPPLATFORM=android-23 make1: Entering directory '/home/user/demo1' x8664 Install :...