Darkcloak

DARKCLOAK Linuxプロセスアイデンティティの偽装 DARKCLOAKは、ユーザー空間から可視のすべてのアイデンティティソースの操作を11フェーズの逐次パイプラインに連鎖させ、プロセスを段階的に変換して、ユーザー空間の監視ツールから見てなりすまし対象のプロセスと区別がつかなくなるまで変化させます。私たちの知る限り、ユーザー空間から可視のすべてのアイデンティティソースを同時に操作することを組み合わせた公開ツールは存在しません。 完全な技術解説はRAZORブログで公開されています。 偽装されるもの taskstruct-comm: PRSETNAME経由 argv0:...

CVE-2019-2215

CVE-2019-2215 AndroidのBad Binder脆弱性に対するエクスプロイト。 @wired0ut 作成。 UAFを悪用して taskstruct をリークし、次に addrlimit を上書きし、cred 内の id ブロックを上書きすることで特権を昇格させます。 研究とエクスプロイトの全フローは こちら にあります（3部構成）。 これは goldfish Android カーネル arm64、バージョン4.14でテストされ、パッチが再導入されました。 実行例： root@kitploit: $ whoami whoami: unknown uid 1000 $ ./p...

CVE-2019-2215

CVE-2019-2215 免責事項: ここで提供されるコードは教育目的およびデモンストレーションのみを目的としています。このコード（またはその情報、ビルド、リポジトリ内の一切の情報）を違法または非倫理的な目的で使用するいかなる人物についても、私は支持せず、一切の責任を負いません。 クレジット Google Project ZeroのJann Horn氏とMaddie Stone氏による概念実証に基づいています このエクスプロイトを書くことを可能にしてくれたCloudFuzzのワークショップに特に感謝します 別の参考資料を提供してくれたkangtasticにも感謝します 使用法...

Linux Distros Unpatched Vulnerability : CVE-2026-90317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final...

Linux Distros Unpatched Vulnerability : CVE-2026-93059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the...

AZL-102240 CVE-2026-90317 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpfspinunlock ends that protection, but the verifier leaves the pointer valid...

CVE-2026-90317

In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpfspinunlock ends that protection, but the verifier leaves the pointer valid...

CVE-2026-93059 drm/msm: Fix task_struct reference leak in recover_worker

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the else branch, leaking a reference on every GPU hang recovery. Patchwork...

EUVD-2026-81978

In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpfspinunlock ends that protection, but the verifier leaves the pointer valid...

CVE-2026-90317: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpfspinunlock ends that protection, but the verifier leaves the pointer valid...

CVE-2026-93059: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the else branch, leaking a reference on every GPU hang recovery. Patchwork...

CVE-2026-64226: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: schedext: Avoid UAF in scxrootenableworkfn init failure path In scxrootenableworkfn, puttaskstructp is called before scxerror dereferences p-comm and p-pid. If the iterator's reference is the last drop, the task is freed...

CVE-2026-23159: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: perf: sched: Fix perf crash with new isusertask helper In order to do a user space stacktrace the current task needs to be a user task that has executed in user space. It use to be possible to test if a task is a user task or not...

CVE-2025-40024

In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhosttask. vhosttaskcreate creates a task and keeps a reference to its taskstruct. That task may exit early via a signal and its taskstruct will be released. A pending vhosttaskwake...

AZL-68799 CVE-2025-40024 affecting package kernel for versions less than 6.6.112.1-2

In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhosttask. vhosttaskcreate creates a task and keeps a reference to its taskstruct. That task may exit early via a signal and its taskstruct will be released. A pending vhosttaskwake...

UBUNTU-CVE-2025-40024

In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhosttask. vhosttaskcreate creates a task and keeps a reference to its taskstruct. That task may exit early via a signal and its taskstruct will be released. A pending vhosttaskwake...

EUVD-2025-35835

In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhosttask. vhosttaskcreate creates a task and keeps a reference to its taskstruct. That task may exit early via a signal and its taskstruct will be released. A pending vhosttaskwake...

CVE-2025-40024

CVE-2025-40024 (Linux kernel) : The vhost subsystem did not robustly handle a task that exits after vhost_task_create(), risking a wake operation accessing a freed task_struct. The fix is to acquire a reference to the task_struct when creating the thread and release it when the vhost_task is remo...

CVE-2025-40024 vhost: Take a reference on the task in struct vhost_task.

In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhosttask. vhosttaskcreate creates a task and keeps a reference to its taskstruct. That task may exit early via a signal and its taskstruct will be released. A pending vhosttaskwake...

CVE-2025-40024: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhosttask. vhosttaskcreate creates a task and keeps a reference to its taskstruct. That task may exit early via a signal and its taskstruct will be released. A pending vhosttaskwake...