threatmap

threatmap...

xtride

XTRIDE：基于N-gram的实用类型恢复 介绍 我们提出了XTRIDE，一种改进的基于n-gram（参见STRIDE）的二进制类型恢复方法，专注于实用性：高度优化的吞吐量和可操作的置信度得分使其能够部署到自动化流水线中。与结构恢复领域的最先进技术相比，我们的方法在实现可比性能的同时，速度提升了70至2300倍。 构建说明 位于 ./bin 中的 CLI 工具需要安装 hdf5 的 1.8.4 或更高版本的库（根据 crate 的文档）。 使用最新版本在 MacOS 上构建会失败，我们建议安装 hdf5 v1.10，例如使用 root@kitploit: brew install...

stride-gpt

STRIDE GPT は、STRIDE 手法に基づいて、与えられたアプリケーションの脅威モデルと攻撃ツリーを生成するために大規模言語モデル（LLM）を活用した、AI を搭載した脅威モデリングツールです。ユーザーは、アプリケーションの種類、認証方法、インターネットに公開されているかどうか、機密データを処理するかどうかなどのアプリケーションの詳細を提供します。モデルは提供された情報に基づいて出力を生成します。 目次 プロジェクトをサポート 特徴 エンタープライズ導入 Open Security Summit でのトーク 変更履歴 インストール リポジトリ構成 使用方法 インタラクティブ RE...

CVE-2026-89906 LoongArch: BPF: Refactor jump offset calculation in tail call

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

setcred

FreeBSD setcred2 — 研究成果 本子目录收集了针对 FreeBSD 14.x 内核中 setcred2 栈缓冲区溢出的文档和可用漏洞利用程序。 漏洞本身在 setcred.txt 中有完整记录。简要说明：kernsetcredcopyinsuppgroups 使用了 sizeofgroups，其中 groups 是 gidt 类型，导致在将数据 copyin 到固定大小的内核栈数组时，步长为 8 字节而非 4 字节。该溢出在任何权限检查之前即可被任何非特权用户触发。 该仓库包含两种可行的利用路径： 无 SMAP / 无 SMEP — exp2lpenosmap.c。通过一...

Astra Linux – Vulnerability in libraw

In LibRaw, there is a out-of-bounds read vulnerability within the “simpledecoderow” function libraw\src\x3f\x3futilspatched.cpp, which can be triggered by an image with a large rowstride field...

The_Automotive_Threat_Modeling_Template

背景 针对汽车相关技术的威胁建模工作坊需要带有自定义元素的DFD、定制化威胁以及具体建议。 由于缺乏专门的汽车威胁建模模板，因此开发了汽车威胁建模模板（Automotive Threat Modeling Template），该模板利用了MS威胁建模工具2016中的一项新功能，该功能允许创建全新的自定义模板。 汽车威胁建模（TM）模板是使用微软（MS）威胁建模工具2016创建的，因此威胁模型也是使用该产品创建的。 解决方案及其特性 汽车威胁建模模板允许创建特定的汽车威胁模型，具备： 与联网汽车组件相关的过程和数据存储。 针对汽车系统定制的外部交互者。...

EUVD-2026-67435

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmwexternalbocopy trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy bound was clamped after...

CVE-2026-80700

CVE-2026-80700 is an out-of-bounds memory access in the Linux kernel's drm/vmwgfx driver, specifically in vmw_external_bo_copy(). The function trusts caller-supplied offsets, strides, and heights when operating on imported dma-buf vmaps. Two defects are fixed: (1) in the equal-stride path, an off...

CVE-2026-80700

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmwexternalbocopy trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy bound was clamped after...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bnxtre: Avoid undefined behavior in bnxtqpliballocinithwq. Undefined behavior occurs when bnxtqpliballocinithwq is called with hwqattr-auxdepth != 0 and hwqattr-auxstride == 0. In that case, rounduppowoftwohwqattr-auxstride is...

Astra Linux – Vulnerability in libpng1.6

LIBPNG is a reference library used in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From version 1.6.26 to 1.6.53, there was an integer truncation in the libpng simplified write API functions pngwriteimage16bit and pngwriteimage8bit, which caused...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, there was a heap buffer over-read vulnerability in the DJVU image format handler. This vulnerability occurred due to integer truncation during the calculation o...

Fedora 44 : firefox (2026-fc11919789)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fc11919789 advisory. Implement buffer stride support for PipeWire camera. ---- - Update to latest upstream 154.0 - Enabled Wayland session restore on KDE. Tenable has...

ANT-2026-3T6Q6WE9 · mpv · Heap Buffer Overflow

heap-buffer-overflow low Severity Claude low · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-3T6Q6WE9: Integer overflow in scaletempo audio filter...

CVE-2026-68262

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

UBUNTU-CVE-2026-68262

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

CVE-2026-68262

CVE-2026-68262 affects the Linux kernel’s drm/imagination: pvr_set_uobj_array() mishandles the destination user array stride when copying kernel objects to userspace. The code previously advanced the userspace pointer by the kernel object size while advancing the kernel pointer by the userspace s...

CVE-2026-68262 drm/imagination: Fix user array stride in pvr_set_uobj_array()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

EUVD-2026-55363

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...