cve-2021-43226PoC

CVE-2021-43226 재현 환경 운영 체제: Hyper-V의 Win10 20H2 빌드 번호 19042.508, 웹사이트 https://os.click/en 발견, Windows 이미지가 비교적 완전하고 아직 백도어를 발견하지 못했습니다. 찾은 PoC는 Visual Studio 2013으로 컴파일되었기 때문에 저도 Visual Studio 2013을 사용하여 정적으로 링크했습니다. 취약점 취약점은 clfs.sys 의 CClfsLogFcbVirtual::QueryLogFileInfo 함수에 있습니다. clfs.sys는...

CVE-2022-0847

CVE-2022-0847 Dirty Pipe linux 커널 권한 상승 분석 toc 이 글은 화웨이 보안 공식 계정에 먼저 게재되었으며, 이쪽은 블로그 버전비교적 완전함입니다. 최초 게재 링크: https://mp.weixin.qq.com/s/6VhWBOzJ7uu80nzFxe5jpg 취약점 개요 취약점 번호: CVE-2022-0847 별칭: 더티 파이프 dirty pipe 취약점 제품: linux kernel - splice syscall 영향 버전: linux 5.8 패치 f6dd975583bd에서 도입, 5.16.11,...

EUVD-2026-82241

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Check acpigethandle status in riscvacpiaddprtdep In riscvacpiaddprtdep, the acpigethandle call can fail which would leave linkhandle uninitialized. Fix it by checking the acpigethandle return status and skip the ent...

CVE-2026-93133 ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep()

In the Linux kernel, the following vulnerability has been resolved: ACPI: RISC-V: Check acpigethandle status in riscvacpiaddprtdep In riscvacpiaddprtdep, the acpigethandle call can fail which would leave linkhandle uninitialized. Fix it by checking the acpigethandle return status and skip the ent...

CVE-2026-90114 net: bridge: Reject descending VLAN tunnel ranges

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

EUVD-2026-81707

In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...

CVE-2026-92914 AVideo LoginControl PGP Second Factor Authentication Bypass

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

CVE-2026-89808

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

DEBIAN-CVE-2026-89808

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

CVE-2026-89910 LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector is declared on stack in function dmsintcinjectirq and sometimes it is used without initialized. Here fix this issue...

EUVD-2026-80510

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector is declared on stack in function dmsintcinjectirq and sometimes it is used without initialized. Here fix this issue...

CVE-2026-89808 drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix the case that vm range is hole at svmmigratecopytovram When migration vm range is hole at cpu sideMIGRATEPFNMIGRATE set + MIGRATEPFNVALID unset driver still allocates device pages. There is no dma map of src pages...

CVE-2019-14079

AndroidでのUSBデバイスファジング CVE-2019-14079 このブログ記事は、USBデバイスファジングを使用して私のAndroidデバイス（MI A2 - ストックAndroid搭載）で発見した単純なバグについてであり、Googleによって深刻度「高」と評価されました。このバグはQualcomm USBドライバに存在し、後に修正され、2020年3月のAndroidセキュリティ情報で開示されました。この脆弱性は、細工されたUSBリクエストをAndroidスマートフォンに送信すると、Androidカーネルがクラッシュし、スマートフォンが再起動するというものです。...

Astra Linux – Vulnerability in libstb

stbimage is a single-file library licensed under MIT, used for processing images. If stbiloadgifmain in stbiloadgiffrommemory fails, it returns a null pointer and may leave the z variable uninitialized. If the caller also sets the vertical flipping flag, the process continues by calling...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8 contains SAUCE patches that may involve the use of an uninitialized variable in the AppArmor AFINET/AFINET6 socket mediation code. This bug can be triggered by a non-privileged local user, and it could lead to incorrect, fine-grained mediation of network sockets...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: nand: ecc-mxic: Fixed the use of an uninitialized variable ret. If ctx-steps is zero, the loop that processes ECC steps is skipped, and the variable ret remains uninitialized. This variable is later checked and returned, whi...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ipv6: Fixed an access bug involving an uninitialized variable in ip6makeskb. Syzbot reported the following bugs: ===================================================== BUG: KMSAN: uninit-value in archatomic64inc...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fixed the issue of using an uninitialized rtpaddr in the processsdp function. The processsdp function declares a union named rtpaddr on the stack and passes it to the nfnatsip sdpsession hook after...

Linux Distros Unpatched Vulnerability : CVE-2026-89554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: fix uninitialized localid in syncookie MPJOIN reconstruction mptcptokenjoincookieinitstate restores remotenonce, localnonce, backup, joinid, token and ms...

DEBIAN-CVE-2026-89554

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized localid in syncookie MPJOIN reconstruction mptcptokenjoincookieinitstate restores remotenonce, localnonce, backup, joinid, token and msk from the saved cookie entry when rebuilding the request socket for ...