70 matches found
dirtyfrag
Dirty Frag:通用 Linux 本地提权漏洞 摘要 本文档描述了由 Hyunwoo Kim @v4bel 首次发现并报告的 Dirty Frag 漏洞类,该漏洞类通过串联 xfrm-ESP 页面缓存写入(CVE-2026-43284) 和 RxRPC 页面缓存写入(CVE-2026-43500) 漏洞,可在主流 Linux 发行版上获得 root 权限。 Dirty Frag 是扩展了 Dirty Pipe 和 Copy Fail 所属错误类的案例。由于它是一个不依赖时间窗口的确定性逻辑漏洞,因此无需竞态条件,漏洞利用失败时内核不会崩溃,且成功率极高。...
copy-fail-checker
Copy Fail Checker — CVE-2026-31431 依存関係が少なく軽量な Bash スクリプトで、Linux システムが Copy Fail ローカル権限昇格脆弱性(CVE-2026-31431)にさらされているかどうかを確認します。 このスクリプトは 読み取り専用 です。脆弱性を悪用することはなく、カーネルモジュールをロードすることも、システムを変更することもありません。 Copy Fail とは Copy Fail は、Linux カーネルの authencesn AEAD 暗号テンプレートにおける論理バグであり、ユーザー空間から...
CVE-2026-43284
🚨 CVE-2026-43284 - Dirty Frag 🚨 Escalada local de privilegios universal en el kernel de Linux 📋 Resumen Dirty Frag también conocido como Copy Fail 2 es una vulnerabilidad de escalada local de privilegios de alto impacto en el kernel de Linux. Permite que un usuario local sin privilegios obtenga...
CVE-2022-22706-poc
CVE-2022-22706 - 页缓存写入 Arm Mali GPU 驱动会将已固定为只读的页面以 CPU 可写映射的形式交给用户空间, 因此非特权进程可以获得一个可写别名,指向某个它只能以 ORDONLY 打开的文件 背后的页缓存。 exploit.c 会清空 /etc/passwd 页缓存中 root 的密码字段,并执行 su root。磁盘上的文件从未被修改。 针对本仓库中的驱动树和 QEMU 目标的 PoC(malikbase r35p0-01eac0 , CONFIGMALINOMALI=y,x8664 GKI 5.15)。在虚拟机中运行它。 漏洞...
DIRTYFAIL
DIRTYFAIL Copy Fail および Dirty Frag Linux ページキャッシュ書き込み脆弱性ファミリーのための統合検出器および PoC ハーネス。 ██████╗ ██╗██████╗ ████████╗██╗ ██╗███████╗ █████╗ ██╗██╗ ██╔══██╗██║██╔══██╗╚══██╔══╝╚██╗ ██╔╝██╔════╝██╔══██╗██║██║ ██║ ██║██║██████╔╝ ██║ ╚████╔╝ █████╗ ███████║██║██║ ██║ ██║██║██╔══██╗ ██║ ╚██╔╝ ██╔══╝...
CVE-2026-43284
Dirty Frag: 汎用Linux LPE 概要 本書では、Hyunwoo Kim @v4bel によって発見・報告された Dirty Frag 脆弱性クラスについて説明します。xfrm-ESP Page-Cache Write CVE-2026-43284 と RxRPC Page-Cache Write CVE-2026-43500 を連鎖させることで、攻撃者は主要な Linux ディストリビューション上で root に昇格できます。 Dirty Frag は Dirty Pipe や Copy Fail...
CVE-2026-89487
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
UBUNTU-CVE-2026-89487
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
CVE-2026-89487
A flaw was found in openvswitch in the Linux kernel. This vulnerability occurs when the queueuserspacepacket function incorrectly modifies a shared network packet buffer by stripping a critical flag. This action can lead to an unprivileged page-cache write, allowing a local attacker to modify dat...
Linux Distros Unpatched Vulnerability : CVE-2026-89487
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message users...
cve-2026-31431
CVE-2026-31431 — Linux 内核 algifaead “复制失败”:分析 针对 CVE-2026-31431 (CVSS 3.1 7.8 高危 , AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)的安全研究:AFALG AEAD 接口链中的三个可组合设计 缺陷串联成一次确定性、无竞态的 4 字节页缓存写入,可写入任意可读文件的任意偏移 ——磁盘副本保持干净,因此磁盘上的校验和看不到任何异常。公开漏洞利用(“复制失败”,Theori/Xint)以 732 字节的 Python 将其转化为本地提权(LPE);该缺陷存在于 2017 年至 2026...
DEBIAN-CVE-2026-89487
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
AZL-100568 CVE-2026-89487 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
CVE-2026-89487
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
EUVD-2026-76393
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
CVE-2026-89487
CVE-2026-89487 affects the openvswitch subsystem in the Linux kernel. The bug resides in queue_userspace_packet(), whose error path calls skb_tx_error() on a packet that is still being forwarded through remaining flow actions. This call strips SKBFL_SHARED_FRAG from the live skb via skb_zcopy_cle...
CVE-2026-89487
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...
PT-2026-90203
In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...