980 matches found
CVE-2026-41651
Pack2TheRoot — CVE-2026-41651 PackageKit 的事务处理器中存在 TOCTOU 竞态。任何本地非特权用户都可以在无需认证的情况下以 root 身份安装任意软件包。 概述 字段| 值 ---|--- CVE| CVE-2026-41651 组件| PackageKit 守护进程（packagekitd） 受影响版本| 1.0.2 – 1.3.4 修复版本| 1.3.5 影响| 本地权限提升 → root 所需认证| 无 用户交互| 无 测试环境| Ubuntu 24.04, Debian 12 演示 漏洞 src/pk-transaction.c 中的三...
CVE-2026-41651
🚨 CVE-2026-41651 — Pack2TheRoot PackageKit 中的权限提升漏洞（TOCTOU 竞态条件） 📌 概述 CVE-2026-41651 是一个影响多种 Linux 发行版中 PackageKit 系统服务的本地权限提升漏洞。 该漏洞由 检查时间到使用时间（TOCTOU）竞态条件 引起，可被滥用以操纵软件包安装流程并将权限提升至 root。 ⚠️ 影响 若成功利用，该漏洞可能允许本地非特权用户： 获得 root 级权限 执行 任意软件包安装脚本（RPM scriptlets） 修改系统级配置 破坏系统完整性与机密性 🧠 注意：该漏洞需要本地访问...
SNEK_Equinox
SNEK Equinox 我要感谢 Nightmare-Eclipse 从项目 UnDefend 中获得的灵感（非个人层面）—— https://web.archive.org/web/20260521145157/https://github.com/Nightmare-Eclipse/UnDefend: 有趣的是，我找到了一种方法，可以向 EDR 的 Web 控制台谎报 Defender 正在运行且已更新至最新版本，即使实际上并非如此。我曾考虑发布代码，但仔细想想，这会造成太大的破坏，所以目前还是先藏起来吧。 - Nightmare-Eclipse...
POC-CopyEscape-CVE-2026-17106
CopyEscape — PoC de CVE-2026-17106 Proof of Concept educativa de CopyEscape CVE-2026-17106, vulnerabilidad de carrera TOCTOU en docker cp que permite a un contenedor malicioso escribir archivos arbitrarios en el host Docker. Inspirada en el trabajo original de masasron , quien descubrio y documen...
CVE-2024-30088-
弱点: CWE-367: 检查时间与使用时间（TOCTOU）条件竞争 CVSS 来源: Microsoft CVSS: 3.1 7.0 / 6.3...
CVE-2026-89766
In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...
CVE-2026-89713
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
CVE-2026-89766 pidfd: hold exec_update_lock around namespace ioctl
In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...
CVE-2026-89713
CVE-2026-89713 is a TOCTOU vulnerability in the Linux kernel's NFSD component. The function nfsd_setattr() checks whether a size update requires NFSD_MAY_TRUNC permission using an unlocked file size sample, but the actual ATTR_SIZE update via notify_change() is applied later under inode_lock(). A...
EUVD-2026-76625
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
CVE-2026-89713 NFSD: check truncate permission under inode lock
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...
CVE-2026-17106
CVE-2026-17106 — CopyEscape: escritura arbitraria de archivos de contenedor a host mediante docker cp Imagen de distribución de HackSpeak. Este repositorio es un espejo de distribución del PoC CopyEscape CVE-2026-17106 publicado por el equipo rojo de Imperva Ron Masas ; el código es idéntico al...
sudo_digest_toctou_poc_CVE-2015-8239
sudoers DigestSpec TOCTOU POC 原理 Alyssa Milburn（https://twitter.com/noopwafel）发现 sudo 中 DigestSpec 设置存在一个 TOCTOU 竞态条件漏洞。DigestSpec 设置可用于允许用户通过 sudo 执行某个二进制文件，前提是该文件的哈希值与预设值匹配。更多关于此功能的信息请参见 man sudoers 并搜索 DigestSpec，关于 Alyssa 发现的漏洞详情，请参见...
CVE-2026-11111-TOCTOU-in-File-Permission-Check-Before-Open
CVE-2026-11111 – 打开前文件权限检查中的 TOCTOU 漏洞 程序代码（Python） root@kitploit: toctouserver.py - File server that checks permission then opens import os, time, tempfile from flask import Flask, request app = Flaskname SAFEDIR = '/tmp/safe' @app.route'/read' def readfile: filename = request.args.get'file'...
BIT-TOMCAT-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets
Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.42 through...
symboliclink-testing-tools
symboliclink-testing-tools c Google Inc. 2015 由 James Forshaw 开发 这是一套用于测试 Windows 各种符号链接类型的小型工具套件，包含以下工具： BaitAndSwitch：创建一个符号链接，并使用 OPLOCK 赢得 TOCTOU（检查时间到使用时间）竞争 CreateDosDeviceSymlink：使用 csrss 创建对象管理器符号链接 CreateMountPoint：创建任意文件挂载点 CreateNtfsSymlink：创建 NTFS 符号链接 CreateObjectDirectory：创建新的对象管理器目...
RLSA-2026:61586 Moderate: tar security, bug fix, and enhancement update
The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...
PT-2026-90434
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writeback store Patch series "zram: fix stale scan bounds after reinitialization". Both writeback store and read block state derive their table scan bounds from zram-disksize before acquiring dev...
PT-2026-90429
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd setattr checks whether a size update needs NFSD MAY TRUNC before it takes inode lock. The comparison uses the file size sampled by that unlocked read, but the actual ATTR SIZE...