retbleed-speculative-execution-poc

Retbleed: Arbitrary Speculative Code Execution via RSB Underflow A hands-on reproduction of Retbleed CVE-2022-29900 / CVE-2022-29901 — the 2022 micro-architectural attack that broke the "Retpoline" defense by proving that ret instructions, long assumed safe, can be hijacked when the CPU's Return...

ghostrace

GhostRace: Explotando y Mitigando Condiciones de Carrera Especulativas Este repositorio contiene: Un PoC minimalista que ejemplifica el concepto de Condición de Carrera Especulativa de forma paso a paso y de un solo hilo. Scripts de Coccinelle utilizados para escanear el kernel de Linux v5.15.83 ...

CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509

🏛️CTT -Microsoft Office OLE Manifold BYPASS CVE-2026-21509 Standardized CTT Implementation for 1096x Temporal Execution ! 📜 漏洞概述 CVE-2026-21509 是 Microsoft Office OLE（对象链接与嵌入）验证引擎中的一个严重绕过漏洞。虽然标准的“层流”利用尝试操纵静态 COM 对象，但本仓库利用定理 4.2 实现了对对象定义规则（ODR）的推测性竞态条件绕过。 🕰️ CTT 优势（定理 4.2） 针对此 CVE...

ssbd-tools

Herramientas para poner en práctica Speculative Store Bypass Disable El proyecto ssbd-tools es una colección de programas que hace uso de la funcionalidad Speculative Store Bypass Disable SSBD proporcionada en los procesadores x86. SSBD es una mitigación basada en el procesador para el ataque...

spectre-attack-demo

Ejemplo de ataque Spectre Ejemplo de uso del exploit "Spectre" revelado el 2 de enero de 2018 CVE-2017-5753 y CVE-2017-5715 Spectre rompe el aislamiento entre diferentes aplicaciones. Permite a un atacante engañar a programas sin errores, que siguen las mejores prácticas, para que revelen sus...

Hardware-Vulnerability-with-Proof-of-Concept-

🛡️ Spectre Variant 2 CVE-2017-5715 — Hardware Vulnerability Research An in-depth research paper and hands-on Proof-of-Concept PoC exploring speculative execution attacks on modern CPUs. 📖 Overview This project is a research and lab-based exploration of Spectre Variant 2 CVE-2017-5715 , also known...

VulnCheck KEV: CVE-2017-5753

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis...

kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability

An attacker executing code on affected system could inject an interrupt at a precise moment to disrupt "Safe RET", the default Linux mitigation for speculative Return Overflow SRSO, which could potentially weaken that protection and may result in information disclosure...

kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability

An attacker executing code on affected system could inject an interrupt at a precise moment to disrupt "Safe RET", the default Linux mitigation for speculative Return Overflow SRSO, which could potentially weaken that protection and may result in information disclosure...

kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability

An attacker executing code on affected system could inject an interrupt at a precise moment to disrupt "Safe RET", the default Linux mitigation for speculative Return Overflow SRSO, which could potentially weaken that protection and may result in information disclosure...

kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability

An attacker executing code on affected system could inject an interrupt at a precise moment to disrupt "Safe RET", the default Linux mitigation for speculative Return Overflow SRSO, which could potentially weaken that protection and may result in information disclosure...

EUVD-2026-66422

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up...

CVE-2026-73108

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up...

CVE-2026-73108 RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up...

CVE-2026-73108 RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up...

PT-2026-82093

Name of the Vulnerable Software and Affected Versions RustDesk versions prior to 1.4.7 Description An uncontrolled speculative memory allocation issue exists in the BytesCodec component. Before authentication, the decoder trusts the payload length specified in a four-byte frame header and reserve...

Ubuntu 20.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8668-1)

"The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8668-1 advisory. Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations,...

Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)

"The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8665-1 advisory. It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vmci: Speculation leaks were prevented by sanitizing the event in eventdeliver. Coverity identified that eventmsg is controlled by user-space. eventmsg-eventdata.event is passed to eventdeliver and used as an index without proper...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A speculative race condition SRC vulnerability that affects modern CPU architectures supporting speculative execution related to Spectre V1 has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the...