CVE-2023-3338-DECPwn

DECPwn 自身のDECnet脆弱性とヌルページマッピングを有効にした状態で、さまざまなLinuxカーネルエクスプロイト技術を練習します。 シナリオ すべて無効 : qemu-system-x8664 -append "nosmap nosmep nopti nokaslr" コード実行はユーザーランドのoutput関数にリダイレクトされ、commitcredspreparekernelcred0を呼び出します。 システムコールフッキング syscalltable 内の mkdir システムコールハンドラアドレスを、シナリオ1のものと類似した関数と置き換えます。 SMEPとKPTI有効...

CVE-2019-10207

CVE-2019-10207 CVE-2019-10207のPoC: Linuxカーネル: bluetooth: hciuart: カーネルNULLポインタデリファレンス root@kitploit: gcc CVE-2019-10207.c -o cve-2019-10207-poc -static 4.20.0でテスト カーネルコンパイルにはCONFIGを有効にする必要があります: root@kitploit: CONFIGBTHCIUARTMRVL=y CONFIGBTMRVL=y...

ioctlance

IOCTLance Description Presented at CODE BLUE 2023, this project titled Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis introduces IOCTLance, a tool that enhances its capacity to detect various vulnerability types in Windows Driver Model WDM drivers. In a...

d-os-descriptor

d-os-descriptor 概要 USB Gadget サブシステムには、compositesetup 関数 composite.c の OS ディスクリプタ処理セクションにセキュリティ上の問題が含まれています。巧妙に細工された制御転送要求メッセージを処理すると、null ポインタ参照またはメモリ破損によってデバイスがクラッシュします。 説明 interface レシピエント向けの compositesetup の OS ディスクリプタ処理セクションは、次のように実装されています。 root@kitploit: case USBRECIPINTERFACE: if windex !=...

BUGS_OOM_NULL_PTR_DEREF

BUGSOOMNULLPTRDEREF AndroidのNULLポインタ参照のバグ、ただのネタのためのOOM...

tpwn

tpwn cve-2015-???? PoC os x 10.10.5 カーネルローカル特権昇格 この脆弱性は 10.11 で潰された 完全な writeup は etason hax してくれた unthreadedjb に shout out tpwn やその他の NULL Pointer Deference バグから身を守るには NULLGuard をインストール...

CVE-2015-8543_for_SLE12SP1

$cat /etc/-release root@kitploit: PRETTYNAME="SUSE Linux Enterprise Server 12 SP1" $id root@kitploit: uid=1000jeremysp1 gid=100users groups=100users $sudo sh disablesecurity.sh $gcc exp.c -o exp 2/dev/null $../nsjail/nsjail -Mo --user 0 --group 0 --keepcaps --chroot / -- /bin/sh -i sh-4.2...

PoC-CVE-2025-69421

CVE-2025-69421 クラッシュ専用再現器 このリポジトリには、隔離された実験環境で CVE-2025-69421 を再現する 最小限の不正な PKCS12 ファイルが含まれています。 生成された PFX には、オプションの encryptedContent フィールドが省略された EncryptedContentInfo を持つ EncryptedData が含まれています。脆弱な OpenSSL バージョンでは、PKCS12unpackp7encdata から PKCS12itemdecryptd2iex に NULL の ASN1OCTETSTRING ポインタが渡され、...

[SECURITY] [DLA 4795-1] openssl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4795-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout September 25, 2026 https://wiki.debian.org/LTS -...

AZL-104460 CVE-2026-98129 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

DEBIAN-CVE-2026-98129

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

CVE-2026-98129

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

DEBIAN-CVE-2026-97593

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iovatophys with ZPCITABLETYPERFX When using a 5-level translation table via ZPCITABLETYPERFX getrsofromiova returns NULL when the region-first entry is invalid. Yet in getrtofromiova the...

CVE-2026-97593

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iovatophys with ZPCITABLETYPERFX When using a 5-level translation table via ZPCITABLETYPERFX getrsofromiova returns NULL when the region-first entry is invalid. Yet in getrtofromiova the...

CVE-2026-97570

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

CVE-2026-97537

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

DEBIAN-CVE-2026-97537

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

EUVD-2026-86965

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98134

The Linux kernel BPF verifier contains a logic error in check_cond_jmp_op() where it incorrectly infers that a pointer is non-null. This occurs during comparisons (e.g., rA == rB) when one pointer type lacks the PTR_MAYBE_NULL flag but can still be NULL at runtime, such as types like PTR_TO_MEM. ...

CVE-2026-98129 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...