skitter-creek-bath-salts

skitter-creek-bath-salts Unlockingeverything on the CPU with DRAM scrambling — PSP, C6, microcode, SMM, and anything else the specs left out. &x == &x. Usually. Poke the DRAM controller and an address can be made to land wherever you want in memory. skitter-creek-bath-salts modifies the bottom...

mmiotic

mmiotic An exploratory tool for MMIO timing — time any physical address, and dissect the hardware off the latency. Unexpectedly useful for hardware reverse-engineering, hypervisor fingerprinting, side-channelling device activity, register characterization, calibrating malicious triggers, and...

SmmExploit

SmmExploit This is a report and an exploit of CVE-2021-26943, the kernel-to-SMM local privilege escalation vulnerability in ASUS UX360CA BIOS version 303. The issue was fixed in the version 304. Issue Description Summary UX360CA BIOS version 303 has 3 vulnerable modules that allow an attacker wit...

z3

Z3 Z3 is a theorem prover from Microsoft Research. It is licensed under the MIT license. Windows binary distributions include C++ runtime redistributables If you are not familiar with Z3, you can start here. Pre-built binaries for stable and nightly releases are available here. Z3 can be built...

SmmBackdoor

SMM backdoor for UEFI based platforms !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! This is legacy abandoned project, for current version of the backdoor check SMM Backdoor Next Gen project page and its documentation: https://github.com/Cr4sh/SmmBackdoorNg...

Platbox

Platbox UEFI and SMM Assessment Tool Features Platbox is a tool that helps assessing the security of the platform: Dumps the platform registers that are interesting security-wise Flash Locks MMIO and Remapping Locks SMM Base and Locks MSRs RW access to the PCI configuration space of devices. RW t...

smm_usbrt_poc

UsbRt SMM Privilege Elevation This is a Proof-of-Concept code that demonstrates the exploitation of the CVE-2017-5721 vulnerability. This PoC causes a system to be completely stuck because of Machine Check Exception occurred. All you need is CHIPSEC Framework installed. And don't forget to put...

UBUNTU-CVE-2026-89604

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

CVE-2026-89604

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

Linux Distros Unpatched Vulnerability : CVE-2026-89604

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of cal...

CVE-2026-89604

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

DEBIAN-CVE-2026-89604

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

AZL-100856 CVE-2026-89604 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

CVE-2026-89604

CVE-2026-89604 affects the Linux kernel's efivarfs filesystem. Unprivileged users can repeatedly call statfs() on the efivarfs mount point, triggering a flood of calls to the QueryVariableInfo() UEFI runtime service. On x86 systems where the EFI variable store is backed by SMM (System Management ...

CVE-2026-89604 efivarfs: Rate limit statfs() handler

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

CVE-2026-89604

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

CVE-2026-89604 efivarfs: Rate limit statfs() handler

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

GIGABYTE-H510M-K-V2-BIOS-SMM-Reverse-Engineering-CVE-2025-7026-7027-7028-7029-Research

GIGABYTE H510M K V2 BIOS SMM Reverse-Engineering & CVE-2025-7026/7027/7028/7029 Research Static reverse-engineering of a GIGABYTE H510M K V2 H510MKV2.F3 BIOS image: full UEFI firmware-volume extraction analysis of the PI-spec SMM Core memory allocator and a targeted hunt for the four SMM...

PT-2026-90320

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

CVE-2025-55575

smm-panel-sqliCVE-2025-55575 Time-based SQL Injection Detection for SMM Panel Overview This template detects a time-based SQL Injection vulnerability in the servicedetail parameter of the SMM Panel via HTTP POST requests to /ajaxdata. Exploitation can allow remote attackers to access sensitive da...