CVE-2026-7878-eBPF-Verifier-Type-Confusion-Kernel-Memory-Read-Write

6. CVE-2026-7878 – eBPF 検証器の型混乱 → カーネルメモリの読み書き 概要 eBPF 検証器の境界追跡における微妙な整数オーバーフローにより、攻撃者は範囲外のカーネルメモリにアクセスする eBPF プログラムを作成できます。 重大度: Critical カーネル特権昇格 ユーザーモード eBPF 検証器シミュレータ C & エクスプロイト // ebpfverifiersim.c - Simulated vulnerable verifier with type confusion include include include include define...

authproof-sdk

AuthProof SDK AuthProof はエージェント型AIのための暗号化委任プロトコルです。この分野のほとんどのプロトコルは、オペレーターが定義したポリシーに基づいて強制を行います。つまり、オペレーターはユーザーの本来の意図を後から拡大または再解釈する権限を持ちます。AuthProof...

CVE-2021-29155

これはCVE-2021-29155の概念実証コードです。 投機的実行領域におけるポインタ演算の範囲追跡システムは不十分でした。 サイドチャネル経由でカーネルデータを抽出することが可能でした。 これは概念実証であり、マップの最後の要素から先へ最大0x5fffバイトの範囲外読み取りができます。 この問題は5.12で修正され（https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=7fedb63a8307dda0ec3b8969a3b233a1dd7ea8...

sgxray

SGXRay: Automating Vulnerability Detection for SGX Apps Intel SGX protects isolated application logic and sensitive data inside an enclave with hardware-based memory encryption. To use such hardware-based security mechanism requires a strict programming model on memory usage， with complex APIs in...

sgxray

SGXRay: SGX 앱을 위한 취약점 탐지 자동화 Intel SGX는 하드웨어 기반 메모리 암호화를 통해 격리된 애플리케이션 로직과 민감한 데이터를 보호합니다. 이러한 하드웨어 기반 보안 메커니즘을 사용하려면 메모리 사용에 대한 엄격한 프로그래밍 모델이 필요하며, 보호 영역 경계 안팎에는 복잡한 API가 있습니다. 보호 영역 개발자는 특히 신뢰할 수 있는 경계를 넘어 흐르는 데이터를 처리할 때 보호 영역 보안을 보장하기 위해 신중한 프로그래밍 방법을 적용해야 합니다. 신뢰할 수 있는 경계 위반은 메모리 손상을 일으킬 수 있으...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CVE-2026-104425

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2...

EUVD-2026-91436

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2...

CVE-2026-104425 Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions

ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2...

CVE-2026-104425

ZcashFoundation Zebra versions before 6.1.0 are susceptible to a resource exhaustion vulnerability. Unauthenticated peers can degrade block processing by pushing transactions containing invalid Orchard proofs without being misbehavior-scored. By repeatedly pushing these invalid proofs into the sh...

CVE-2017-16995

CVE-2017-16995 记录一下自己折腾的CVE-2017-16995漏洞和相关分析 （希望能自己找个，笑 概述 此漏洞由于bpf虚拟执行时，校验器分支判断错误所引起的LPE 原理上是整数扩展漏洞 分析 触发 https://ph4ntonn.github.io/CVE-2017-16995-trigger.html 利用 https://ph4ntonn.github.io/CVE-2017-16995-exploit.html 结构 https://ph4ntonn.github.io/CVE-2017-16995-structure.html EXP 此处下载，请自行编译...

grlh

このひとつの奇妙なトリックでebpf verifierを無効化 twitter.comで紹介されたもの https://twitter.com/bleidl/status/871527499984982016...

CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: BPF 検証器の 1 バイトからコンテナエスケープへ Linux BPF 検証器にサウンドネスバグを発見しました。pushstack 呼び出し内の + 1 により、分岐したパスで ALU 命令が 1 つスキップされます。BPFOR の場合、CPU が 0 | K = K を計算している間、検証器は dst = 0 と追跡します。完全なコンテナエスケープを書き上げました。BPF マップからの OOB 読み書き、vtable ハイジャック、modprobepath 上書き、ホストでの root 取得です。その後、2 パッチのシリーズ（1 文字の検証器修正と 9...

CVE-2020-8835

CVE-2020-8835 Linuxカーネル5.5.0以降では、bpf検証器（kernel/bpf/verifier.c）が32ビット演算のレジスタ境界を適切に制限しないため、カーネルメモリ内での範囲外読み取りおよび書き込みが発生します。 この脆弱性は、導入コミットがそのブランチにバックポートされたため、v5.4.7以降のLinux 5.4安定シリーズにも影響します。 この脆弱性は、5.6.1、5.5.14、5.4.29で修正されました。 この脆弱性の緩和策は、「kernel.unprivilegedbpfdisabled」sysctlを「1」に設定することで利用可能です。...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1787291758)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1787291758 advisory. - The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known ...

CVE-2026-93125

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This vulnerability occurs because the verifier does not correctly handle certain buffer size arguments, allowing values larger than a 32-bit integer. When these oversized values are processed, they are truncated, leading ...

CVE-2026-95354

An use after free flaw was found in the Verifier component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=524582798...

DEBIAN-CVE-2026-95354

Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-95354

Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-95354

Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...