17 matches found
CVE-2026-104795 Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution
The insights-runtime-extractor runs as a privileged DaemonSet hostPID: true that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. forks a child process 2. setns into the target container's PID and mount namespaces 3. fchdir back to an orphaned F...
CVE-2026-104795
The insights-runtime-extractor DaemonSet is vulnerable to a container escape due to insufficient privilege dropping during runtime fingerprinting. The coordinator uses seteuid() to switch users, but it fails to change the real UID (ruid) or saved-set-UID , which remain at 0 . Furthermore, the sec...
CVE-2026-104795 Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution
The insights-runtime-extractor runs as a privileged DaemonSet hostPID: true that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. forks a child process 2. setns into the target container's PID and mount namespaces 3. fchdir back to an orphaned F...
kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel
A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...
linux-copy-fail-exploit
CVE-2026-31431 Copy Fail - LPE Exploit PoC !Pythonhttps:...
CVE-2026-29121
IDC SFX2100 satellite receiver ships with /sbin/ip setuid, enabling local privilege escalation; a local user can leverage GTFObins ip to read root files and potentially perform additional privileged actions on the local system.
EUVD-2005-2925
Malware in sbrugna...
EUVD-2016-7485
Malware in sbrugna...
SUSE CVE-2022-31252
A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the...
CVE-2022-31252
A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the...
CVE-2022-31252 permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()
A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the...
CVE-2018-14634
An integer overflow flaw was found in the Linux kernel's createelftables function. An unprivileged local user with access to SUID or otherwise privileged binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable...
CVE-2016-6564
Android devices with code from Ragentek contain a privileged binary that performs over-the-air OTA update checks. Additionally, there are multiple techniques used to hide the execution of this binary. This behavior could be described as a rootkit. This binary, which resides as /system/bin/debugs,...
Design/Logic Flaw
Android devices with code from Ragentek contain a privileged binary that performs over-the-air OTA update checks. Additionally, there are multiple techniques used to hide the execution of this binary. This behavior could be described as a rootkit. This binary, which resides as /system/bin/debugs,...
USN-1009-1: GNU C Library vulnerabilities
Tavis Ormandy discovered multiple flaws in the GNU C Library's handling of the LDAUDIT environment variable when running a privileged binary. A local attacker could exploit this to gain root privileges. CVE-2010-3847, CVE-2010-3856...
CVE-2005-2925
runpriv in SGI IRIX allows local users to bypass intended restrictions and execute arbitrary commands via shell metacharacters in a command line for a privileged binary in /usr/sysadm/privbin...