Document-Linux-Privilege-Escalation

Linux Privilege Escalation via snapd Project Goal: Exploiting the vulnerability called "DirtySock" CVE-2019-7304 in the REST API for Canonical's snapd daemon a default service in Ubuntu Linux, to gain root access. Ramil Mustafayev's Guide:...

suricata_exporter

Suricata Prometheus Exporter This is a Prometheus Exporter for Suricata using dump-counters via the unix socket to query metrics. Usage $ ./suricataexporter -h Usage of ./suricataexporter: -suricata.socket-path string Path to the Suricata Command socket. default "/var/run/suricata.socket" -versio...

CVE-2024-31317

CVE-2024-31317 Preface A couple of days ago, I saw an analysis of the CVE-2024-31317 vulnerability posted on JD's official account. After reading it through, I found it quite interesting. Moreover, the current mainstream solutions for automotive IVI In-Vehicle Infotainment are all based on Androi...

CVE-2021-40438

CVE-2021-40438 exploit PoC with Docker setup CD into the directory containing the Apache configuration and Dockerfile shared in repo. Building Image: docker build -t cve-2021-40438:1.0 . Running the Docker Image: docker run --rm -d -p 4444:80 cve-2021-40438:1.0 Note: You can also use Image ID...

SUSE CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

DEBIAN-CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

UBUNTU-CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116497 Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

EUVD-2026-109941

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116497

A NULL pointer dereference vulnerability exists in gssproxy within the gssx_init_sec_context function. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field missing, the daemon dereferences a NULL pointer, causing a crash. This vulnerability is accessible via the Unix socket...

CVE-2026-116497 Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

CVE-2026-116497

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

PT-2026-123352

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX INIT SEC CONTEXT request is received with the target name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy...

Linux Distros Unpatched Vulnerability : CVE-2026-116497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon...

Astra Linux – Vulnerability in haveged

In src/havegecmd.c, the sockethandler function performs a credential check on the abstract UNIX socket \0/sys/entropy/haveged. However, while it detects that the connecting user is not root cred.uid != 0 and prepares a negative acknowledgment ASCIINAK, it fails to stop execution. The code proceed...

RHLW-2026-778FAAA627FD5B22 Lightwell Security Advisory: netty-transport-native-kqueue 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-transport-native-kqueue 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2026-45536: Netty: Unix-socket fd receive leaks descriptors when peer sends two at once This patched artifact is a drop-in replacement for...

RHLW-2026-A889D214E9EF7D94 Lightwell Security Advisory: netty-transport-native-epoll 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-transport-native-epoll 4.1.100.Final-rhlw-00001 with a backported security fix. CVE-2026-45536: Netty: Unix-socket fd receive leaks descriptors when peer sends two at once This patched artifact is a drop-in replacement for...