79 matches found
nftables-oob-read-write-exploit-CVE-2023-35001-
nftables oob read/write exploit CVE-2023-35001 Exploit used at pwn2own Vancouver 2023 on Ubuntu desktop. The exploit supports the kernel version available at the beginning of the event 5.19.0-35. Requirements C compiler Go compiler Usage Build $ make Run $ ./exploit This produces a lpe.zip file...
CVE-2022-1015
CVE-2022-1015 A write-up and Local Privilege Escalation Proof-of-Concept of an OOB read and write vulnerability in the Linux Kernel. You can find the write-up of this vulnerability on my blog and you can find my introduction to nftables here as well. An Important note The exploit provided in this...
CVE-2021-30632
From: https://github.com/github/securitylab/tree/main/SecurityExploits/Chrome/v8/CVE-2021-30632 The analysis of this bug can be found here. This is a Chrome bug that is reported by an anonymous researcher and was believed to be exploited in the wild. The exploit here is tested on v8 version...
CVE-2024-5274
CVE-2024-5274 authors: @mistymntncop, @buptsb Shoutout to @buptsb for his major contribution of discovering both the DCHECK bytecode mismatch POC and then discovering how to elevate that primitive to more powerful OOB read/write primitives. Without him this exploit would not be possible :- based ...
Elysium-Vanguard-Sentinel-Audit
SENTINEL-ROOT-AUDIT: Honor Magic V2 Hypervisor Detection Suite ➲ Project Overview SENTINEL-ROOT-AUDIT is a professional-grade security suite designed to audit kernel integrity and detect hypervisor-level interventions on the Honor Magic V2 SM8550. While the core vulnerability CVE-2025-38352 allow...
kernel security, bug fix, and enhancement update
An update is available for kernel. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...
RockyLinux 9 : kernel (RLSA-2026:86033)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86033 advisory. kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-5293...
Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_85321)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202685321 advisory. kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-529...
Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_86033)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686033 advisory. kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935...
kernel security, bug fix, and enhancement update
An update is available for kernel. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...
CLSA-2024-1723622106 Fix of 29 CVEs
Ubuntu: 4.15.0-234.245 CVE-url: https://ubuntu.com/security/CVE-2024-42236 - usb: gadget: configfs: Prevent OOB read/write in usbstringcopy CVE-url: https://ubuntu.com/security/CVE-2024-41095 - drm/nouveau/dispnv04: fix null pointer dereference in nv17tvgetldmodes CVE-url:...
RHEL 9 : kernel (RHSA-2026:86033)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86033 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: openvswitch: defer tunnel...
AlmaLinux 9 : kernel (ALSA-2026:86033)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:86033 advisory. kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
RHEL 10 : kernel (RHSA-2026:85321)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85321 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: openvswitch: defer tunnel...
CVE-2026-105958 Spice-server: spice: heap oob read/write via unchecked migration data offsets
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...
CVE-2026-105958
A flaw in spice-server allows an authenticated SPICE client to perform out-of-bounds read and write operations during VM live migration. The vulnerability exists because multiple migration data handlers fail to perform bounds validation on client-supplied offsets from SPICE_MSGC_MIGRATE_DATA mess...
CVE-2026-84286 OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions...
CVE-2026-84286 OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions...