CVE-2024-21626

CVE-2024-21626 この脆弱性の詳細な説明については、私の記事を参照してください。 エクスプロイト コンテナの実行によるエクスプロイト カスタムイメージをビルドする必要はありません。-w パラメータを指定してコンテナを実行するだけです: root@kitploit: docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm 実行中のコンテナへの exec によるエクスプロイト runc 自体によるエクスプロイト root@kitploit: /container/runc/runc...

CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume

CVE-2026-5555 – /proc/self/fd シンボリックリンクによるコンテナエスケープ 概要 rshared 伝播でマウントされた共有ボリュームにより、悪意のあるコンテナが /proc/self/fd を介してホストファイルを指すシンボリックリンクを作成できます。ボリュームに書き込むホストプロセスがそのシンボリックリンクを辿ることで、重要なホストファイルが上書きされ、コンテナからのエスケープが発生します。 脆弱性の詳細 種類: コンテナエスケープ / シンボリックリンク攻撃 影響: ホストファイルの上書き、ホスト上での root への権限昇格。 根本原因:...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the OpenAtNoFollow process. An attacker can cause unintended file ownership or permission changes on host files by placing a symlink in the virt-launcher filesystem, which is then followed via...

PT-2026-52087

Name of the Vulnerable Software and Affected Versions KubeVirt affected versions not specified Description A flaw exists in the safepath package used by virt-handler. The OpenAtNoFollow function utilizes O PATH|O NOFOLLOW to obtain a file descriptor for a path leaf; however, subsequent operations...

CLSA-2026-1778599539 Fix CVE(s): CVE-2026-4878

SECURITY UPDATE: TOCTOU race condition in capsetfile - debian/patches/CVE-2026-4878.patch: open the target file and operate on /proc/self/fd/N so the inode is locked between the regular-file check and the xattr update - CVE-2026-4878...

Exploit for File Descriptor Leak in Linuxfoundation Runc

CVE-2024-21626 For detailed explanation for this vulnerabilit...

SUSE CVE-2022-45412

When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. This bug only affects Thunderbird on Unix-based operated systems Android, Linux, MacOS. Windows is unaffected.. This...

Mozilla: Symlinks may resolve to partially uninitialized buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...

Mozilla: Symlinks may resolve to partially uninitialized buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...

Mozilla: Symlinks may resolve to partially uninitialized buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...

Mozilla: Symlinks may resolve to partially uninitialized buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...

curl: Unexpected access to process open files via file:///proc/self/fd/n

Summary: fileconnect routine https://github.com/curl/curl/blob/1b71bc532bde8621fd3260843f8197182a467ff2/lib/file.cL134 does not prevent access to /proc/self/fd pseudo filesystem. Application using libcurl and accepting URLs to fetch can be tricked to return content of any open file by passing a...