CVE-2019-0708

CVE-2019-0708 BlueKeep 事前認証RCEのPoC（Windows 7向け） このリポジトリは、Windows リモートデスクトップサービス（RDS）におけるリモートコード実行のバグを示しています。 これは、私たちが以前に開発したBlueKeep脆弱性に関するPoCコードと技術レポートです。 注記: 私たちの目的は、アナリストが重大な脆弱性についてより深く理解できるよう支援することです。 使い方 前提条件 エクスプロイトコードは Python 3 で記述されており、PyRDP ライブラリに依存しています。PyRDPのインストールガイドに従ってセットアップしてください。...

RDS_CVE-2019-0708

RDSCVE-2019-0708...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

aws_public_ips

awspublicips...

Linux Distros Unpatched Vulnerability : CVE-2026-90081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or t...

AZL-102839 CVE-2026-90081 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

CVE-2026-90081

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

DEBIAN-CVE-2026-90081

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

EUVD-2026-81942

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

CVE-2026-90081 net/rds: use wq_has_sleeper() in rds_cong_map_updated()

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

CVE-2026-21533_Scanner.py

CVE-2026-21533 扫描器：Windows RDP 本地权限提升检测工具 本仓库包含一个针对 CVE-2026-21533 漏洞的检测 工具，该漏洞是 Windows 远程桌面服务（RDS）中的权限管理缺陷，可能允许本地攻击者将其权限提升至 SYSTEM。 重要提示： 此脚本是一个教育性和检测性的概念验证（PoC） 。其目的是帮助系统管理员和安全团队（蓝队）快速识别其网络中可能易受攻击的系统。它不是漏洞利用工具 ，不包含任何执行权限提升的代码。 漏洞背景（CVE-2026-21533） 描述： Windows 远程桌面服务中的权限管理不当。 影响：...

PinTheft-go

pintheft-go Go 移植版 pintheft - RDS zcopy 双重释放本地权限提升。属于 Dirty Frag 漏洞类别。 !IMPORTANT Arch Linux 是该漏洞最容易暴露的发行版之一，因为它是少数几个默认情况下通常可以加载 RDS 模块的发行版之一。 工作原理（长话短说） 该漏洞位于 rdsmessagezcopyfromuser 函数中。该函数通过 FOLLGET 逐个 GUP-钉住用户页面。如果后续页面发生页错误（例如 PROTNONE 保护页），错误路径会对已钉住的页面调用 putpage，然后 rdsmessagepurge 再次对这些页面调用...

CVE-2026-43494-PinTheft-PoC

SLEY — PoC de PinTheft CVE-2026-43494 Prueba de concepto — uid=1000raken → uid=0root después de ./sley en WSL2 6.6.87.2-microsoft-standard-WSL2 Prueba de concepto en un solo archivo para CVE-2026-43494 PinTheft: una escalada de privilegios local del kernel de Linux que encadena un error de conteo...

CVE-2026-48282-coldfusion-rds-detection

CVE-2026-48282 — Adobe ColdFusion RDS 検証と検出 Adobe ColdFusion Remote Development Services RDS における CVE-2026-48282 のラボ検証。技術的証拠、イベント再構築、防御的検出の機会に焦点を当てています。 このリポジトリは、脆弱なRDS...

CVE-2026-43494

🛠️ PinTheft — CVE-2026-43494 Escalada de Privilegios Local en el Kernel de Linux mediante RDS + Sobrescritura de Caché de Páginas con iouring 📌 Resumen PinTheft es un exploit de root local sofisticado para CVE-2026-43494 , un error de conteo de referencias en el subsistema de Sockets de Datagramas...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC（CVE-2026-43494） 概念验证 — uid=1000raken → uid=0root 执行 ./sley 后，在 WSL2 上（6.6.87.2-microsoft-standard-WSL2） 针对 CVE-2026-43494 （ PinTheft ）的单文件概念验证：一个 Linux 内核本地权限提升漏洞，利用 RDS zerocopy 引用计数错误 结合 iouring 固定缓冲区 来覆盖 SUID-root 二进制文件的页缓存。 免责声明： 本仓库仅用于 授权的安全研究、教育和防御性测试...

pintheft

PinTheft — RDS 零拷贝双重释放 LPE 追踪站点 PinTheft 补丁状态追踪器的源码：一个单页站点，记录哪些发行版已针对 Linux 内核中的 RDS 零拷贝双重释放权限提升漏洞发布了修复。 事实在哪里 关于该漏洞的一切信息——CVE ID、受影响版本与修复版本、上游修复提交、发现与披露致谢，以及各发行版的最终补丁状态——均属于追踪器页面，而非本 README： 网页版： https://kimmo.cloud/pintheft/ 源码： site/content/index.md 编辑该文件；本仓库中的其余内容均为构建基础设施。 此处故意不重复这些内容。若在 READ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fixed an issue where a use-after-free occurred in net in reqsktimerhandler. syzkaller reported a warning regarding the netns tracker 0, followed by KASAN, SPLAT 1, and another ref tracker warning 1. syzkaller was unable...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: rds: Fixed a possible NULL pointer dereferencing issue. In the rdsrdmacmeventhandlercmn function, if the conn pointer exists before dereferencing it as an argument for rdmasetservicetype, a problem was identified. This issue...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/rds: fixed the warning in rdsconnconnectifdown. If a connection is not established yet, getmr will fail, causing the connection to be initiated after getmr...