CVE-2025-14174-Poc

CVE-2025-14174 PoC 漏洞利用程序 概述 本仓库包含一个功能完整的 CVE-2025-14174（也记为 EUVD-2025-203113）概念验证（PoC）漏洞利用程序，该漏洞是 ANGLE 图形引擎中的一个严重内存损坏漏洞。其根本原因在于对内存缓冲区边界内操作的限制不当（CWE-119），使得通过特制的网页内容能够进行越界内存访问。 该漏洞利用程序针对网络浏览器，主要聚焦于 iOS 设备（最高至 iOS 26），但已在多种使用 ANGLE 的平台上测试并确认有效，包括基于 Chrome、Edge 和 Safari 的 Android、Windows 和 macOS...

cve-2024-0519-rca-research

CVE-2024-0519 — RCA Research Artefactos de análisis de causa raíz para CVE-2024-0519 acceso a memoria fuera de los límites en V8, Chrome 120, explotado activamente. Corrección : e0f2a195d87c9a06685121e0e783efd92d030df3 — Toon Verwaest, 2024-01-12 Versión de V8 estudiada : 12.0.267.16 fbc4963bbff,...

CVE-2022-1015-1016

CVE-2022-1015 & CVE-2022-1026 This README.md is a translation of David's blog. David found CVEs 1015 and 1016 in the Linux kernel. You can visit his website to read the original document. Here are his social media links: Twitter Github An analysis of the two new Linux vulnerabilities in nftables...

CVE-2026-80844

🔥 CVE-2026-80844 - DirtyAH6 Escalada de privilegios local en el kernel de Linux mediante IPv6 AH6 CVE-2026-80844 es una vulnerabilidad del kernel de Linux que afecta al subsistema IPv6 Authentication Header AH6 / XFRM. La vulnerabilidad se debe a una validación insuficiente del campo segmentsleft...

CVE-2025-40019-POC

CVE-2025-40019 概念验证 CVE-2025-40019 是加密盐扇区初始化向量机制（crypto/essiv.c）中的一个漏洞，该机制对关联认证数据（AAD）长度相对于初始化向量（IV）大小的验证不足，导致越界内存访问。 此仓库中的代码仅为漏洞触发程序，但该漏洞易于利用。 KernelCTF 参赛记录 我在 kernelctf 的电子表格中发现了这个漏洞 链接。由于该漏洞没有相关的博客文章或 PoC，我决定探索 Linux 内核的加密子系统，以查明问题原因。 背景：磁盘加密理论与 ESSIV 要理解 ESSIV 的必要性，我们必须先了解数据在磁盘上的存储方式。磁盘加密（如...

CVE-2021-1732

CVE-2021-1732 漏洞发生在Windows 图形驱动win32kfull!NtUserCreateWindowEx函数中的一处内核回调用户态分配内存与tagWND-flag属性设置不同步导致的漏洞。使得可以伪造这个tagWND-offset值发生内存越界。...

CVE-2022-1015

CVE-2022-1015 objetivo: kernel de Linux 5.17.0 config: .config requisitos: root@kitploit: apt install libmnl-dev libnftnl-dev compilar: root@kitploit: gcc exploit.c -o exploit -lmnl -lnftnl -lpthread -no-pie Referencias...

CVE-2025-51495

Me gustaría informar sobre una vulnerabilidad de seguridad identificada en la última versión de Mongoose v7.17. El problema reside en el módulo WebSocket, específicamente dentro de la función mgwscb encargada de manejar los frames WebSocket entrantes. La función es vulnerable a un desbordamiento ...

d-os-descriptor

d-os-descriptor 概述 USB小工具子系统在compositesetup函数（composite.c）的OS描述符处理部分存在安全问题。处理精心构造的控制传输请求消息会因空指针解引用或内存损坏而导致设备崩溃。 描述 compositesetup中针对接口接收者的OS描述符处理部分实现如下。 root@kitploit: case USBRECIPINTERFACE: if windex != 0x5 || wvalue 8 break; interface = wvalue & 0xFF; buf6 = windex; count =...

CVE-2024-29943-but-with-wasm

CVE-2024-29943, pero con wasm Una cadena de explotación de extremo a extremo para CVE-2024-29943 que logra ejecución de código nativo arbitrario introduciendo shellcode en la página de código JIT de WebAssembly de SpiderMonkey como inmediatos f64.const — sin ROP, sin VirtualProtect, sin toolchain...

CVE-2026-21001-WebAssembly-Linear-Memory-OOB-via-Table-Index-Confusion

CVE-2026-21001 – WebAssembly Linear Memory OOB via Table Index Confusion Overview A WebAssembly module uses an imported function with no bounds check on an array index. An attacker can supply an out-of-bounds index to read or write outside the linear memory, potentially leaking host secrets or...

CVE-2021-32537

CVE-2021-32537: RTKVHD64 中的越界访问导致池损坏。 这是我于2021年4月初报告给瑞昱半导体的一个漏洞。受影响的驱动程序名为RTKVHD64.sys，似乎存在于多种主流硬件中（测试了以下硬件配置，但可能还有更多存在漏洞）： Microsoft Surface Laptop, Microsoft Surface Book, Microsoft Surface Pro, 联想 Thinkpad, Dell XPS 13. 瑞昱半导体告知我该漏洞已修复，修复程序通过 Windows...

CVE-2019-9810

CVE-2019-9810 Windows 版 Firefox 利用程序 CVE-2019-9810 是一个由 Richard Zhu 和 Amat Cama 在 Pwn2Own 2019 上发现并利用的漏洞。它影响了 Mozilla 的 JavaScript 引擎 Spidermonkey，并被用于实现渲染进程的攻破。 该问题已于大约两个月前在 mfsa2019-09 中修复。 问题概述 简而言之，该漏洞使得边界检查判定为冗余并被优化掉，从而允许代码访问越界内存。问题本身出在 Ion 管道的别名分析阶段。下图展示了 GVN...

Linux Distros Unpatched Vulnerability : CVE-2026-93127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX,...

AZL-102294 CVE-2026-93177 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

CVE-2026-93127

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

DEBIAN-CVE-2026-93127

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

CVE-2026-90341

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboottablepopulate bounds checks limit individual entries to the mapped length. However, coreboottableprobe replaces the platform resource length with header and table siz...

DEBIAN-CVE-2026-90203

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk for example the offset into the decompressed fragment block, this will cause squashfscopydata to perform an out of bounds access. Fix by checking ...

CVE-2026-90205

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate orphan slot during inode read Patch series "ocfs2: validate active orphan slots during inode read". OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes. A corrupted slot can therefore index...