ZigRaceExploit

CVE-2021-25741 — Zig中的TOCTOU符号链接竞态利用 关于TOCTOU（检查时间，使用时间）竞态条件的教育性利用，它是CVE-2021-25741的根源，该漏洞存在于Kubernetes kubelet中。 该项目在本地（无需K8s集群）演示了并发符号链接交换如何能够绕过lstat和open之间的路径检查，并证明带有RESOLVE标志的openat2是解决方案。 目录 问题 利用的工作原理 代码架构 前提条件 构建 使用 本地Docker测试 openat与openat2对比 调整TOCTOU延迟 在真实Kubernetes节点上测试 预期结果 代码解释...

CVE-2024-21626

关于 复现步骤 确保内核版本 = 5.4,4.19,.. 并且 /proc/kallsyms 中存在 openat2。v1.0.0-rc93= runc =1.1.11 root@kitploit: $ grep openat2 /proc/kallsyms ffffffffa64290d0 T pfxauditopenat2how ffffffffa64290e0 T auditopenat2how ffffffffa666de90 t pfxdosysopenat2 ffffffffa666dea0 t dosysopenat2 ffffffffa666e020 t...

Security update for tar

This update for tar fixes the following issues Security fixes: CVE-2026-5704: crafted archives can be used to to hide file injection bsc1261900. Other fixes: Fix tar changing dir permissions temporarily even when using --no-overwrite-dir. Fix --dereference/-h not working properly after...

SUSE-SU-2026:2714-1 Security update for tar

This update for tar fixes the following issues Security fixes: - CVE-2026-5704: crafted archives can be used to to hide file injection bsc1261900. Other fixes: - Fix tar changing dir permissions temporarily even when using --no-overwrite-dir. - Fix --dereference/-h not working properly after...

GHSA-F2R5-5M7W-P5CX opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

Summary An unprivileged process can easily trigger the processPIDEvents goroutine to be blocked indefinitely, preventing the goroutine from analyzing any new ELF file. The goroutine stays blocked in the openat2 syscall forever and the profiler can no longer work properly, it is a denial of servic...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the processPIDEvents goroutine. An attacker can cause the agent to become unresponsive by triggering the goroutine to block indefinitely in the openat2 syscall, preventing further...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the processPIDEvents goroutine. An attacker can cause the agent to become unresponsive by triggering the goroutine to block indefinitely in the openat2 syscall, preventing further...

PT-2026-51617

Name of the Vulnerable Software and Affected Versions opentelemetry-ebpf-profiler versions prior to 0.0.202622 Description An unprivileged process can cause a denial of service on the ebpf-profiler agent by triggering the processPIDEvents goroutine to block indefinitely. This occurs when the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Audit: Do not dereference the syscall arguments when checking the openat2 openhow::flags. According to Jeff, dereferencing the openat2 syscall argument in auditmatchperm to obtain the openhow::flags can lead to an oops/page-fault...

UBUNTU-CVE-2026-43619

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module...

OCI layer symlink escape → arbitrary host write

Affected versions of boxlite extract OCI image layer tarballs without fully containing path resolution to the extraction root. A crafted layer containing a symlink whose target is an absolute on-host path e.g. escape - /tmp followed by a file entry that resolves through that symlink e.g...

Oracle Linux 9 : tar (ELSA-2026-0067)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-0067 advisory. 2:1.34-9 - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277 also, fix another tiny mistake in the patch w/o visible consequences...

Oracle Linux 10 : tar (ELSA-2026-0002)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-0002 advisory. 2:1.35-9 - Fix a tiny mistake in the last patch affecting hardling extraction w/o visible consequences 2:1.35-8 - Backport upstream changes to jailify extracti...

tar security update

2:1.34-9 - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277 also, fix another tiny mistake in the patch w/o visible consequences 2:1.34-8 - Backport upstream changes to jailify extraction directory Includes related gnulib changes to add openat2 Fixes CVE-2025-45582...

SUSE CVE-2022-48832

In the Linux kernel, the following vulnerability has been resolved: audit: don't deref the syscall args when checking the openat2 openhow::flags As reported by Jeff, dereferencing the openat2 syscall argument in auditmatchperm to obtain the openhow::flags can result in an oops/page-fault. This...

CVE-2022-48832

In the Linux kernel, the following vulnerability has been resolved: audit: don't deref the syscall args when checking the openat2 openhow::flags As reported by Jeff, dereferencing the openat2 syscall argument in auditmatchperm to obtain the openhow::flags can result in an oops/page-fault. This...

DEBIAN-CVE-2022-48832

In the Linux kernel, the following vulnerability has been resolved: audit: don't deref the syscall args when checking the openat2 openhow::flags As reported by Jeff, dereferencing the openat2 syscall argument in auditmatchperm to obtain the openhow::flags can result in an oops/page-fault. This...

CVE-2022-48832

In the Linux kernel, the following vulnerability has been resolved: audit: don't deref the syscall args when checking the openat2 openhow::flags As reported by Jeff, dereferencing the openat2 syscall argument in auditmatchperm to obtain the openhow::flags can result in an oops/page-fault. This...

UBUNTU-CVE-2022-48832

In the Linux kernel, the following vulnerability has been resolved: audit: don't deref the syscall args when checking the openat2 openhow::flags As reported by Jeff, dereferencing the openat2 syscall argument in auditmatchperm to obtain the openhow::flags can result in an oops/page-fault. This...

CVE-2022-48832 audit: don't deref the syscall args when checking the openat2 open_how::flags

In the Linux kernel, the following vulnerability has been resolved: audit: don't deref the syscall args when checking the openat2 openhow::flags As reported by Jeff, dereferencing the openat2 syscall argument in auditmatchperm to obtain the openhow::flags can result in an oops/page-fault. This...