Jump-over-ASLR-BTB

分支预测器与 ASLR 作者：Byte Reaper 描述 该仓库包含一个研究性 C 实现，用于演示在地址空间布局随机化（ASLR）背景下与分支预测器、推测执行和基于缓存的侧信道相关的概念。 要求： root@kitploit: Linux x8664 GCC CPU that supports BTB 构建： root@kitploit: gcc btb.c -o BTB ./BTB 快速输出（示例）： root@kitploit: + check System Security for Check branch predictors... + Sleep Success. - Not...

Attacker-Group-Predictor

Attacker-Group-Predictor このツールは、使用されたテクニックやソフトウェアから攻撃者グループを予測します。MITRE ATT&CK™ フレームワークに基づいて検索を行います。 仕組み 1- https://attack.mitre.org/ から攻撃者グループのデータを収集 2- ユーザーから攻撃に関するデータを取得 3- データを比較し、結果を作成 インストール root@kitploit: git clone https://github.com/omergunal/Attacker-Group-Predictor.git cd...

CVE-2021-33624

CVE-2021-33624 の概念実証 コンパイル方法 gcc -pthread -o bpfspectretypeconfusion bpfspectretypeconfusion.c -Wall -ggdb -std=gnu99 実行方法 sudo ./bpfspectretypeconfusion 1 2 ffffffffa4925620 0x10 ここで、1 と 2 は異なるハードウェアコアで動作する CPU スレッド、ffffffffa4925620 は漏洩させたい対象メモリ、0x10 は漏洩させるバイト数です。このエクスプロイトは修正されていますが、sudo...

CVE-2023-0045

绕过 Linux 上的 Spectre-BTI 用户空间缓解措施 这是一份工作文档，如果您认为我们有错误或遗漏了引用，请向我们发送反馈 版本 1.0 José Oliveira esoj Rodrigo Branco BSDaemon 引言 在测试 Spectre-BTI 攻击的成功率时，我们使用内核 API 作为缓解措施1时检测到一种异常模式。我们的测试表明，Linux 内核未能正确缓解攻击，导致进程在系统调用后短时间内仍处于暴露状态。 进一步调查显示，内核在系统调用期间并未立即发出 IBPB。ibprctlset2 函数更新任务的线程信息标志 TIF 并在...

spectre-attack-example

Spectre 攻撃の例 2018年1月2日 CVE-2017-5753 および CVE-2017-5715 「ゴースト」Spectre 脆弱性の悪用例 これは何か？ メモリにテキスト "The Magic Words are Squeamish Ossifrage." を配置し、脆弱性を利用して読み出そうとします。システムが脆弱であれば、標準出力に同じテキストが表示されます。 このコードでは、victimfunction 内のコンパイル命令が厳密なプログラム順に実行されると、array1size = 16 のため、関数は array10..15...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

The non-transparent sharing of return predictor targets between contexts in some Intel processors may allow an authorized user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in Intel Microcode

The exposure of sensitive information due to shared microarchitectural predictor states, which affect transient execution for some IntelR Core™ processors 10th generation, may allow an authenticated user to potentially disclose information through local access...

Astra Linux – Vulnerability in Intel Microcode

The non-transparent sharing of return predictor targets between contexts in some Intel processors may allow an authorized user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in Linux 5.15, Linux

Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type, potentially leading to information disclosure...

Astra Linux – Vulnerability in Intel Microcode

The exposure of sensitive information due to shared microarchitectural predictor states, which affect transient execution in the indirect branch predictors of certain Intel processors, may allow an authenticated user to potentially disclose information through local access...

CVE-2026-64507

A flaw was found in the Linux kernel. This vulnerability involves an incomplete defense against Spectre-v2, a type of attack that can expose sensitive information by exploiting how modern processors predict future operations. Specifically, when the Berkeley Packet Filter BPF Just-In-Time JIT...

SUSE CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

UBUNTU-CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508 bpf: Support for hardening against JIT spraying

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508 bpf: Support for hardening against JIT spraying

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508

CVE-2026-64508 relates to a Linux kernel vulnerability in BPF JIT memory reuse. The issue arises when the BPF JIT allocator reuses space for new programs, potentially letting indirect jumps reuse stale branch predictions. Fix implemented: flush indirect branch predictors on JIT memory reuse via a...

EUVD-2026-48852

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64508

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

CVE-2026-64507 x86/bugs: Enable IBPB flush on BPF JIT allocation

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF...