windows_tcpip_fuzz

windowstcpipfuzz これは、scapyを使用してWindowsのtcpip.sysドライバをファジングする試みです。この脆弱性に触発されました: https://doar-e.github.io/blog/2021/04/15/reverse-engineering-tcpipsys-mechanics-of-a-packet-of-the-death-cve-2021-24086/...

CVE-2026-100076

A flaw was found in the Linux kernel's rtl8723bs wireless network driver. When handling wireless management frames under certain error conditions, the driver fails to release allocated transmission frames and buffers back to their memory pools. An attacker within radio range could send unexpected...

CVE-2026-97966

A flaw was found in the Linux kernel's Marvell OCTEON TX2 network driver. When tearing down Hierarchical Token Bucket HTB quality-of-service queues, the driver fails to clear hardware scheduler topology configurations before returning queues to the shared pool. A local user with network...

CVE-2026-97962

A flaw was found in the Linux kernel's mlx5 network driver. The driver fails to hold the required lock when destroying virtual network interface health reporters during device unloading. A local user with administrative privileges could trigger this flaw by unbinding the driver, resulting in a...

CVE-2026-97957

A flaw was found in the Linux kernel's hinic network driver. An attacker with access to send mailbox messages, such as from a guest operating system utilizing a Virtual Function VF, a virtualized network interface, can exploit insufficient validation of message segment lengths. This flaw can caus...

CVE-2026-97953

A flaw was found in the Linux kernel's stmmac network driver. An attacker can cause a Denial of Service DoS by transmitting highly fragmented network packets that use TCP Segmentation Offload TSO. Due to an improper calculation of required transmit descriptors, the driver writes past available...

CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

CVE-2026-97603

A flaw was found in the Linux kernel's idpf network driver. This flaw allows a local user with administrative privileges to cause a Denial of Service DoS through a kernel crash. The issue occurs because dynamic interrupt moderation DIM background tasks are not disabled before releasing queue vect...

CVE-2026-97434

A flaw was found in the Linux kernel's dpaa2-switch network driver. During device removal, network packet polling instances NAPI shared across switch ports can be deleted before they are properly disabled. A local user with administrative privileges could trigger this issue during device teardown...

CVE-2026-97411

A flaw was found in the Linux kernel's IBM EMAC network driver. During module removal, the driver unconditionally attempts to disable network polling routines even if they were never enabled or were already stopped. This improper state handling causes the kernel to enter an infinite loop, resulti...

CVE-2026-93830

A flaw was found in the Linux kernel's stmmac network driver. An attacker can cause a Denial of Service DoS by sending high volumes of network traffic to an affected system. Under heavy packet load, the network controller exhausts its receive buffers and continuously fires hardware interrupts...

CVE-2026-97569

A flaw was found in the Linux kernel's Broadcom NetXtreme-E bnxten network driver. An attacker can cause a Denial of Service DoS by sending a burst of network traffic followed by a large UDP Segmentation Offload USO packet. When operating with small transmit ring configurations, the driver...

etherleak-checker

Etherleak 脆弱性チェッカー このPythonスクリプトは、ネットワークパケットのパディングデータを解析することで、対象ホストのEtherleak（CVE-2003-0001）脆弱性を検出するのに役立ちます。このスクリプトはScapyを使用して、さまざまなタイプの要求（ICMP、ARP、TCP）を送信し、レスポンスにメモリの機密内容を漏えいさせる可能性のあるパディングデータが含まれているかどうかをチェックします。 Etherleak の概要 Etherleak...

CVE-2026-98028

A flaw was found in the Linux kernel's Netronome Flow Processor NFP network driver. When replacing an existing flow steering rule fails during hardware reprogramming, the driver fails to remove the old rule from its internal list, creating an inconsistency with the active rule counter. A local us...

CVE-2026-98016

A flaw was found in the Linux kernel's Mellanox network driver mlx5e. A race condition occurs during the concurrent teardown of traffic control TC sample rules sharing the same context, causing the system to reference memory after it has already been freed. A local user with network administrativ...

CVE-2026-98014

A flaw was found in the Linux kernel's Mellanox network driver mlx5. This vulnerability allows a local privileged user to cause a Denial of Service DoS through a system crash. During hardware reset or error recovery procedures, improper cleanup when disabling a virtual network port leaves stale...

CVE-2026-93279

A flaw was found in the Linux kernel's Octeon network driver. During network device shutdown or driver removal, a pending cleanup task may execute after associated network device structures have already been freed from memory. A local user could exploit this race condition during device teardown ...

kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...

CVE-2026-93278

A flaw was found in the Linux kernel's Octeon network driver. During interface shutdown, the driver deletes the packet polling mechanism without properly disabling it first, allowing active polling routines to continue running after interrupt handlers are released. A local attacker could exploit...

kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...