ipv6_frag_escape

IPV6FRAGESCAPE 一个针对CentOS / RHEL 10的可靠的未特权容器/监狱逃逸概念验证。 它利用了Linux内核中一个现已修复的IPv6分段漏洞，位于ip6appenddata函数中（上游通过 38becddc 修复，无CVE），这是一个 slab 内的线性溢出，溢出到数据包自身头部对象尾部的 skbsharedinfo 结构中。本README仅记录利用链，不涵盖触发条件。 范围 目标：CentOS / RHEL 10（内核 6.12.x，例如 6.12.0-242.el10）。 起始条件：一个位于网络隔离容器内的未特权进程，能够访问未特权用户命名空间。...

chronomaly

Chronomaly Chronomaly 是一个利用 CVE-2025-38352 的 Android/Linux 内核漏洞利用程序。该漏洞利用专门针对 Linux 内核 v5.10.157 编写，但由于不需要任何特定内核文本偏移量，它应适用于所有有漏洞的 v5.10.x 内核。 我在一个三部分的博客系列文章中详细介绍了该漏洞，从 PoC 一直讲到漏洞利用： 第一部分 - Android 内核漏洞分析与 PoC（野外） 第二部分 - 在没有内核补丁的情况下扩展竞态窗口 第三部分 - 揭示 Chronomaly 构建设置 该漏洞利用仅在 QEMU 中运行的 x8664 Linux 内核...

CVE-2019-2215

CVE-2019-2215 Android binderバグの記録。エミュレータでのみテストしています : ubuntu 22.04 | 4G | 4 cpus andriod studio Pixel2 | Andriod 10.0Q--Google Play Intel x86 Atom 64 System Image | API-29 ndk 21.0.6113669 origin/android-goldfish-4.14-dev | カーネルバージョンは 4.14.175 いくつかの重要な設定オプション CONFIGSLABFREELISTRANDOM is not set...

CVE-2025-21756

CVE-2025-21756 — エクスプロイトラボ 教育的および許可されたセキュリティ研究目的のみに使用してください。 説明 CVE-2025-21756 は、2025年2月26日に公開された Linux カーネルの vsock 仮想ソケット サブシステムにおける use-after-free UAF 脆弱性です。影響を受ける Linux システム上で、ローカルの攻撃者が root への権限昇格 を可能にします。 CVSS v3.1: 7.8 重要 ベクトル: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE: CWE-416 解放後使用...

CVE-2022-23222-POC

CVE-2022-23222 の概念実証エクスプロイトコード これは CVE-2022-23222 の PoC です。これは Local Privilege Escalation（ローカル権限昇格）の脆弱性です。 この PoC はカーネルバージョン 5.13.0-27-generic の Ubuntu 20.04 用に作成されましたが、他のカーネルバージョンも影響を受けます。 エクスプロイトの詳細な分析については、write-up をお読みください。 使い方 エクスプロイトの前提条件として、libbpf がインストールされていることを確認してください。 POC...

SUSE CVE-2026-97614

In the Linux kernel, the following vulnerability has been resolved: net: dsa: tagbrcm: legacy FCS: request needed tailroom The legacy FCS tagger calculates the CRC over skb-len bytes starting at skb-data. When a nonlinear skb reaches the tagger, this reads past the linear head into unrelated slab...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2024_0134)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20240134 advisory. kernel: use after free in unixstreamsendpage CVE-2023-4622 kernel: vmwgfx: reference count issue leads to use-after-free in surface handling CVE-2023-5633...

Rocky Linux 10.0 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_12662)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202512662 advisory. kernel: padata: fix UAF in padatareorder CVE-2025-21727 kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtphidremove CVE-2025-21928 kernel:...

Rocky Linux 10.0 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_16904)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202516904 advisory. kernel: fs: export anoninodemakesecureinode and fix secretmem LSM bypass CVE-2025-38396 kernel: smb: client: fix use-after-free in cifsoplockbreak...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc (crlsa-2021_3440)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20213440 advisory. kernel: slab-out-of-bounds access in xdrsetpagebase in net/sunrpc/xdr.c CVE-2021-38201 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2025_9580)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259580 advisory. kernel: cifs: fix double free race when mount fails in cifsgetroot CVE-2022-48919 kernel: security/keys: fix slab-out-of-bounds in keytaskpermission...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1771081379)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771081379 advisory. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after- free Read in...

Rocky Linux 10.1 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_0453)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20260453 advisory. kernel: HID: multitouch: fix slab out-of-bounds access in mtreportfixup CVE-2025-39806 kernel: audit: fix out-of-bounds read in auditcomparednamepath...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1771081379)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1771081379 advisory. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after- free Read in...

Exploit for Double Free in Linux Linux_Kernel

CVE-2026-52993 — reproduction Double-free / slab-use-after-fr...

CVE-2021-42008

CVE-2021-42008 Linux 6pack ドライバにおける 16 年前の脆弱性の悪用 参照 https://syst3mfailure.io/sixpack-slab-out-of-bounds...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1753298962)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753298962 advisory. - In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udffindentry Syzbot...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1762332910)

"The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1762332910 advisory. - In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible UAF when remounting r/o a mmp-protected file...

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2025:1763722365)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2025:1763722365 advisory. - In the Linux kernel, the following vulnerability has been resolved: bpf: Don't use tnumrange on array range checking for poke...

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1787292462)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1787292462 advisory. - In the Linux kernel, the following vulnerability has been resolved: netfilter: validate user input for expected length I got...