CVE-2022-0847

CVE-2022-0847 説明 - CVE-2022-0847のPOC: Linuxカーネルのローカル権限昇格脆弱性。 - antxによって2022-03-08に作成されました。 詳細 - セキュリティ研究者のMax Kellermannは責任を持って'Dirty Pipe'脆弱性を開示し、Linuxカーネル5.8以降、Androidデバイスにも影響を与えると述べました。 - Linuxカーネル5.8以降の脆弱性で、任意の読み取り専用ファイルのデータを上書きできる。これにより、特権のないプロセスがルートプロセスにコードを注入できるため、権限昇格につながる。 -...

cve-2019-6207

CVE-2019-6207 root@kitploit: $ clang exploit.c -o exploit $ ./exploit CVE-2019-6207 exploit to leak 4 bytes of arbitrary kernel memory Tested on MacOS 10.14.1, should works on: MacOS wop != NETRTDUMP2 int size = rtmsg2RTMGET, &info, NULL, w, credp; if w-wreq != NULL && w-wtmem != NULL struct...

CVE-2025-5777

CVE-2025-5777 Citrix NetScaler メモリリークエクスプロイト !WARNING このスクリプトは教育および研究目的のみ を意図しています。明示的な許可 なしにシステムに対して使用しないでください。不正アクセスやテストは違法かつ非倫理的です。このスクリプトを使用する前に、完全なDISCLAIMERをお読みください。 概要 このプロジェクトは、Citrix NetScaler アプライアンスで発見されたメモリリーク脆弱性 CVE-2025-5777 を実証するものです。この脆弱性は、不正な POST データ 特に login パラメータ...

CVE-2025-5419

CVE-2025-5419 V8における不正なTurboshaft Store-Store Eliminationによる未初期化読み取りの脆弱性。 このリポジトリには、この脆弱性を悪用してV8サンドボックス内での任意読み取り/書き込み、AddressOfおよびFakeObjectプリミティブを実現するための解析と安定化されたエクスプロイトが含まれています。 解析: CVE-2025-5419.pdf 再現情報 OS: Ubuntu 24.04 Git コミット: 609a85c2a1bd77d6f6905369f4bc4fcf34c5db09 謝辞 バグを発見してくれたClement...

Ticketbleed

Ticketbleed このツールはTicketbleed（CVE-2016-9244）の脆弱性を悪用するためのツールです。srcフォルダ内のTicketbleedライブラリはgoのcrypto/tlsを修正したバージョンで、handshakeclient.go, tls.go, common.go ファイルにいくつかの変更が加えられていますが、ほぼ同じものです。 ビルド root@kitploit: cd Ticketbleed mv Ticketbleed.go.tmp Ticketbleed.go go get github.com/EgeBalci/Ticketbleed go...

DEBIAN-CVE-2026-98109

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

CVE-2026-97610

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix uninitialized return value in netfsunbufferedwrite If preparation of the first subrequest fails, netfsunbufferedwrite exits its loop before ret is initialized. The empty-iterator check can do the same. For synchronous...

DEBIAN-CVE-2026-97610

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix uninitialized return value in netfsunbufferedwrite If preparation of the first subrequest fails, netfsunbufferedwrite exits its loop before ret is initialized. The empty-iterator check can do the same. For synchronous...

EUVD-2026-86940

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

CVE-2026-98109

A race condition exists in the Linux kernel Bluetooth hci_core component during device registration. Specifically, in hci_register_dev(), the power_on work item is queued before hdev->adv_monitors_idr is initialized and before the MSFT extension is registered via msft_register(). For devices w...

CVE-2026-98109 Bluetooth: hci_core: Fix race condition during device registration

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

CVE-2026-98089

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in albdeterminend albdeterminend uses icmp6hdrskb to inspect ICMPv6 headers. However, in xmit paths e.g. packets sent via AFPACKET / raw sockets or forwarded packets,...

EUVD-2026-86684

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in removenhgrpentry removenhgrpentry prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a...

CVE-2026-98031

The Linux kernel is vulnerable to a null pointer dereference within the nexthop component. Specifically, the remove_nh_grp_entry() function prints the extack message when a listener fails to replace a reduced nexthop group; however, extack is not initialized and listeners are not required to set ...

CVE-2026-98031 nexthop: Initialize extack in remove_nh_grp_entry()

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in removenhgrpentry removenhgrpentry prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a...

CVE-2026-97965

The Linux kernel contains a vulnerability in the vxlan component where a packet transmitted through a device configured with VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP can cause information leakage. If the external ip_tunnel_info lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, the md pointer remains pointi...

EUVD-2026-86819

In the Linux kernel, the following vulnerability has been resolved: vxlan: initialize md in vxlanxmitone If a VXLAN device is configured with both VXLANFCOLLECTMETADATA and VXLANFGBP, and a packet is transmitted through it using an external iptunnelinfo that lacks the IPTUNNELVXLANOPTBIT flag, md...

CVE-2026-97965 vxlan: initialize _md in vxlan_xmit_one()

In the Linux kernel, the following vulnerability has been resolved: vxlan: initialize md in vxlanxmitone If a VXLAN device is configured with both VXLANFCOLLECTMETADATA and VXLANFGBP, and a packet is transmitted through it using an external iptunnelinfo that lacks the IPTUNNELVXLANOPTBIT flag, md...

CVE-2026-97963

The Linux kernel contains a vulnerability in the stmmac driver where the ptp_lock (an rwlock) is only initialized during __stmmac_open(). Because the lock is accessed by stmmac_get_time() during tc_taprio_configure() even when the interface is down and never opened, using the uninitialized lock r...

CVE-2026-97963 net: stmmac: initialize ptp_lock at probe time

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptplock at probe time priv-ptplock is only initialized in stmmacptpregister, which runs during stmmacopen. However, the lock is also used while the interface is down and has never been opened:...