kernel-exploits

Kernel Exploits Various kernel exploits CVE-2021-22555 Linux local root exploit. Updated version of theflow's exploit for CVE-2021-22555. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a D...

CVE-2023-0386

typora-copy-images-to: ./image CVE-2023-0386 Exploit Usage: First : Upload fuse.c and exp.sh to the /tmp directory. You can use scp or python3 -m http.server to upload the file to the target. scp /Desktop/CVE-2023-0386/exp.sh [email protected]:/tmp scp /Desktop/CVE-2023-0386/fuse.c...

CVE-2024-1086

CVE-2024-1086 For learning purpose. Refer: https://pwning.tech/nftables/ https://github.com/Notselwyn/CVE-2024-1086 Kconfig: +CONFIGCONFIGFSFS=y +CONFIGSECURITYFS=y +CONFIGNFTABLES=y mnlcbrun: Operation not supported +CONFIGNETFILTERNETLINKGLUECT=y +CONFIGNETLINKDIAG=y +CONFIGNFTCT=y...

CVE-2026-64531

CVE-2026-64531 — OVSwrap Linux kernel Open vSwitch module local privilege escalation normal user → root PoC. Exploits the integer wraparound of the 16-bit nlalen field to escalate from a normal user all the way to root. Vulnerability Summary When the nested action stream generated by OVS exceeds...

OVSwrap

OVSwrap CVE-2026-64531 Writeup !WARNING The PoC is provided solely to help defenders, maintainers, and authorized security teams validate patches, mitigations, detections, and exposure on systems they own or are explicitly authorized to test. You are solely responsible for ensuring that your use ...

CVE-2015-1328

CVE-2015-1328 TryHackMe Walkthrough – Linux Kernel Privilege Escalation CVE-2015-1328 Objective The goal of this walkthrough was to escalate privileges from a low-privileged user karen to root by exploiting a vulnerable Linux kernel. Step 1 – Initial Enumeration After connecting to the target...

container-cve-2021-22555

CVE-2021-22555 の再現コードをコンテナとして提供 まず、こちらのエクスプロイトコードを便利なプリビルドコンテナとしてまとめたものです： https://github.com/google/security-research/tree/master/pocs/linux/cve-2021-22555 プリビルドコンテナ： quay.io/cgwalters/cve-2021-22555 緩和策：seccomp プロファイル 強力な緩和策として、cloneCLONENEWUSER を拒否する seccomp を有効にすることが挙げられます。アップストリームの Kubernete...

foxcage

foxcage Run Firefox in a rootless Podman container for security isolation. Your browser runs with almost no Linux capabilities, in its own user and network namespace, isolated from the host — while still having full GPU acceleration, audio, and DRM support. Why foxcage? Firefox already has a...

kernel-exploits

カーネルエクスプロイト さまざまなカーネルエクスプロイト CVE-2021-22555 Linux ローカルルートエクスプロイト。 theflow 氏による CVE-2021-22555 の エクスプロイト の更新版。 net/netfilter/xtables.c において、Linux v2.6.19-rc1 以降に影響するヒープの境界外書き込みが発見されました。これにより、攻撃者はユーザー名前空間を通じて権限を取得したり、DoS（ヒープメモリ破壊による）を引き起こしたりすることが可能になります。 CVE-2019-13272 Linux ローカルルートエクスプロイト。 Jann Ho...

CVE-2024-56433

CVE-2024-56433 shadow-utils - Insecure default subordinate ID assignment for local users Summary The default subordinate ID assignment creates risk for collision with existing user ID's, creating potential for arbitrarily changing UID/GID and gaining unauthorized access to data and network...

CVE-2022-1227_Exploit

CVE-2022-1227Exploit A script for exploiting CVE-2022-1227. Background Ubuntu 20.10 is recommanded. Podman TODO: add what is the principle of this vulnerability Install podman Follow the instruction in the official document: https://podman.io/getting-started/installationinstalling-on-linux For...

CVE-2019-5736-Custom-Runtime

CVE-2019-5736-Custom-Sandbox General CVE-2019-5736 implemented using a shallow, self-written container runtime to understand the exploit. Exploit is based on and almost all copied from the runc-poc by twistlock: https://github.com/twistlock/RunC-CVE-2019-5736/tree/master/maliciousimagePOC Contain...

kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface vti6 component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kerne...

Rocky Linux 8 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel (crlsa-2024_3163)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243163 advisory. pam: allowing unprivileged user to block another user namespace CVE-2024-22365 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc (ALMALINUX9.2:CLSA-2025:1762180294)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762180294 advisory. - A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause...

SUSE CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

CVE-2026-98021

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by triggering excessive memory consumption on the host. When creating or updating network interfaces through the routing netlink rtnetlink interface, the kernel fails to validate and enforce maximum limits on the...

CVE-2026-98009

A flaw was found in the Linux kernel's Enhanced Transmission Selection ETS network scheduler. A local user with network administration privileges, including an unprivileged user inside a user namespace, can configure traffic control queue disciplines with invalid or unconstrained quantum...

CVE-2021-22555-Exploit

CVE-2021-22555-Exploit CVE-2021-22555 Exploit By Andy Nguyen INFO A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a DoS via heap memory corruption through user name space 編譯 gcc -m32 -stati...

CVE-2017-7184

CVE-2017-7184 – Linux Kernel XFRM Privilege Escalation No Sudo Overview This repository contains a proof-of-concept local privilege escalation exploit for CVE-2017-7184 , a Linux kernel vulnerability in the XFRM IPsec netlink subsystem. The exploit demonstrates how an unprivileged user can gain...