nftables-oob-read-write-exploit-CVE-2023-35001-

Exploit de lectura/escritura fuera de límites OOB en nftables CVE-2023-35001 Exploit utilizado en pwn2own Vancouver 2023 en Ubuntu de escritorio. El exploit admite la versión del kernel disponible al comienzo del evento 5.19.0-35. Requisitos Compilador de C Compilador de Go Uso root@kitploit: Bui...

cve-2023-21987-poc

cve-2023-21987-poc Oracle VirtualBox VGA 越界读取漏洞 此概念验证（PoC）专为在 Windows 宿主机上运行的 Linux 客户机操作系统设计。 此 PoC 旨在演示泄漏 VirtualBox 组件地址的能力。你可能需要调整 vgaexp 函数内的指针值，以匹配你正在测试的特定版本。 目前，成功率相对较低。非常欢迎贡献以提高其可靠性。...

CVE-2022-1015

CVE-2022-1015 关于 Linux 内核中越界读取与写入漏洞的详细分析及本地权限提升概念验证代码。 你可以在我的博客上找到该漏洞的深入分析，同样你也可以在那里找到我对 nftables 的介绍。 重要说明 本仓库提供的漏洞利用代码不应期望在开箱即用的易受攻击内核版本上成功运行。 不同内核构建之间会存在许多偏移量差异，当然也包括不同的 ROP 小工具。 有时，由于内核构建之间的差异，甚至可能不得不改变利用漏洞的方式。例如，David Bouman @pqlqpql 对该漏洞的另一篇分析文章（可在此查看）中，他使用 UDP 数据包 来利用漏洞——针对处理 UDP...

CVE-2021-30632

From: https://github.com/github/securitylab/tree/main/SecurityExploits/Chrome/v8/CVE-2021-30632 El análisis de este error se puede encontrar aquí. Este es un error de Chrome reportado por un investigador anónimo y se cree que fue explotado en la naturaleza. El exploit aquí presentado se probó en ...

weightBufs

WeightBufs: WeightBufs es un exploit de lectura/escritura del kernel para todos los dispositivos Apple con soporte de Neural Engine. Errores y exploit por @simo36; puedes leer mis diapositivas de la presentación en POC para más detalles sobre las vulnerabilidades y las técnicas de explotación. El...

Linux Distros Unpatched Vulnerability : CVE-2026-89633

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields wit...

Linux Distros Unpatched Vulnerability : CVE-2026-89720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ubifs: fix out-of-bounds read in signature length check ubifssbverifysignature bounds the on-disk ubifssignode-len field before handing the signature payload to...

Linux Distros Unpatched Vulnerability : CVE-2026-89583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it...

Linux Distros Unpatched Vulnerability : CVE-2026-89614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: bound the free-cluster bitmap scan to the volume vol-lcnemptybitsperpage is sized from vol-nrclusters at mount, but ntfsclusteralloc bounds its scan of th...

Linux Distros Unpatched Vulnerability : CVE-2026-89634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd smb/client: fix possible infinite loop and oob read in...

CVE-2026-89705

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

DEBIAN-CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

CVE-2026-89633

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

AZL-100644 CVE-2026-89621 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

DEBIAN-CVE-2026-89583

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

AZL-100524 CVE-2026-89583 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

DEBIAN-CVE-2026-89573

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

CVE-2026-89571

In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc copies cmd-inlen bytes into inbuf = kvzalloccmd-inlen and passes inbuf and inlen to -fwrpc. The CXL callback cxlctlfwrpc ignores inlen and never checks the...

CVE-2026-89541

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...