NetworkSandboxEngine

A Linux engine for deterministic nftables firewall testing inside isolated network namespaces. Why NSE? • Oracle contract • Wire assertions • Features • Requirements • Installation • Quickstart • How It Works • Project Structure Why NSE? Testing firewall rulesets on a live Linux system poses...

CVE-2023-0179-PoC

Needle CVE-2023-0179 exploit This repository contains the exploit for my recently discovered vulnerability in the nftables subsystem that was assigned CVE-2023-0179, affecting all Linux versions from 5.5 to 6.2-rc3, although the exploit was tested on 6.1.6. The vulnerability details and writeup c...

LeitWacht

GitLab Runner Leitwacht Network egress enforcement for GitLab Runner CI/CD containers. Leitwacht prevents supply chain attacks from exfiltrating secrets by controlling what each job container can access on the network. How It Works Leitwacht is a standalone agent that runs alongside GitLab Runner...

CVE-2024-1086

CVE-2024-1086 For learning purpose. Refer: https://pwning.tech/nftables/ https://github.com/Notselwyn/CVE-2024-1086 Kconfig: +CONFIGCONFIGFSFS=y +CONFIGSECURITYFS=y +CONFIGNFTABLES=y mnlcbrun: Operation not supported +CONFIGNETFILTERNETLINKGLUECT=y +CONFIGNETLINKDIAG=y +CONFIGNFTCT=y...

LeitWacht Agent

leitwacht-agent https://leitwacht.eu — source of truth: https://gitlab.com/leitwacht/leitwacht-agent. Issues, MRs, and discussions live on GitLab. Pre-1.0. The 0.x series is pre-stable; minor releases may carry breaking changes to APIs, env-var names, helm values.yaml keys, and rule-file schema...

nixos-config

Lan Tian's NixOS Configuration This repository holds the configuration files for all my NixOS systems. Features Full system root-on-tmpfs, using impermanence Nftables instead of iptables Secret management with sops-nix QEMU user mode emulation for most architectures Nix Flakes with Nixpkgs patchi...

nftables-oob-read-write-exploit-CVE-2023-35001-

nftables oob read/write exploit CVE-2023-35001 Exploit used at pwn2own Vancouver 2023 on Ubuntu desktop. The exploit supports the kernel version available at the beginning of the event 5.19.0-35. Requirements C compiler Go compiler Usage Build $ make Run $ ./exploit This produces a lpe.zip file...

CVE-2023-35001

nftables oob read/write exploit CVE-2023-35001 Exploit used at pwn2own Vancouver 2023 on Ubuntu desktop. The exploit supports the kernel version available at the beginning of the event 5.19.0-35. Requirements C compiler Go compiler Usage Build $ make Run $ ./exploit This produces a lpe.zip file...

CVE-2023-0179-PoC

Needle CVE-2023-0179 exploit This repository contains the exploit for my recently discovered vulnerability in the nftables subsystem that was assigned CVE-2023-0179, affecting all Linux versions from 5.5 to 6.2-rc3, although the exploit was tested on 6.1.6. The vulnerability details and writeup c...

CVE-2022-32250

CVE-2022-32250 This is my exploit for CVE-2022-32250, written entirely based on the research from NCC Group's blog. Tested on: Kernel version 5.13 Success rate: 70% Building Building requires libmnl and libnftnl. make all Disclaimer The Proof-of-Concept and the write-up of the vulnerability are f...

CVE-2022-1015

CVE-2022-1015 target: linux kernel 5.17.0 config: .config requirements: apt install libmnl-dev libnftnl-dev build: gcc exploit.c -o exploit -lmnl -lnftnl -lpthread -no-pie References...

TransparentTorProxy

A Linux CLI tool that transparently routes all system traffic through the Tor network using nftables. Features • Requirements • Installation • Usage • How It Works • Verification • Contribute No per-application setup needed - just sudo ttp start and every connection goes through Tor. !CAUTION TTP...

CVE-2022-1015

My POC for CVE-2022-1015 Compile: gcc -o exploit exploit.c helpers.c -lmnl -lnftnl -lpthread -no-pie...

NFtables-IPtables-integration-script

🛡️ Q-Feeds Linux Firewall Blocklist Integration Automated malware IP blocklist for Linux servers — supports nftables and iptables+ipset 📋 Table of Contents Quick Start Overview How It Works Prerequisites Detailed Installation Configuration Usage and Verification Troubleshooting Uninstalling Licens...

CVE-2022-1015

CVE-2022-1015 Root Cause In the nftparseregister function, because there is no validation when the arg defaults, an out-of-bounds OOB occurs on the stack of the nftdochain function. At this point, using the payload expression allows both read and write. The payload operates as follows: That is, b...

cve-2026-98432-mitigation

cve-2026-98432-mitigation Temporary protection for Linux servers: a narrow IPv4 TCP filter, state verification, backup and rollback. The audit separates the kernel fix from the filter's operation. Audit: работающее ядро → пакет → основание → UNKNOWN при нехватке данных Protection: inet + bridge →...

cve-2026-98432

CVE-2026-98432 mitigation for Ubuntu 16.04, 22.04, 24.04 and 26.04 Quick start 1. Inspect the host; no changes. sudo ./cve-2026-98432-mitigate.sh check 2. Get a patch-state verdict for the exact running kernel package. sudo ./cve-2026-98432-mitigate.sh assess 3. Apply the stopgap filter and make ...

cve-2026-98432-nft

CVE-2026-98432 nftable dorp nftables mitigation for CVE-2026-98432: drop IPv4 TCP SYNs that carry IP options, as early as nftables can. The CVE is a use-after-free in the IPv4 TCP request-socket path ireq-ireqopt / inetopt, read in ipoptionsbuild. The proper fix is a kernel update; this only...

cve-2026-98432-nft-mitigation

CVE-2026-98432 nft mitigation Agent skill that applies, verifies, persists, and later removes the interim host mitigation for Linux kernel CVE-2026-98432 CVSS 9.8: a single nftables rule dropping TCP packets carrying IPv4 options — the only input that reaches the inetopt/ireqopt use-after-free in...

cve-2026-98432-mitigation

CVE-2026-98432 mitigation for Ubuntu An interim mitigation for CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code that affects kernels back to 4.4. This does not patch your kernel. It makes the bug harder to reach until Ubuntu ships a fixed kernel. Install that kernel when it's...