CVE-2025-21756

CVE-2025-21756 — 利用实验室 仅供教育和授权的安全研究目的使用。 描述 CVE-2025-21756 是 Linux 内核 vsock （虚拟套接字）子系统中的一个 释放后使用（UAF） 漏洞，于 2025 年 2 月 26 日披露。它允许本地攻击者在受影响的 Linux 系统上将 权限提升至 root 。 CVSS v3.1： 7.8（高） 向量： AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE： CWE-416（释放后使用） 受影响组件： net/vmwvsock/afvsock.c 受影响内核： Linux...

PT-2025-34364

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A flaw exists in the vsock subsystem that allows a vsock to autobind to VMADDR PORT ANY. This can lead to a use-after-free issue when a connection is established to the bound socket, a...

PT-2025-30876

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a time-of-check-to-time-of-use TOCTOU issue within the vsock subsystem. Specifically, vsock find cid and vsock dev do ioctl may experience a race condition duri...

kernel: vsock: remove vsock from connected table when connect is interrupted by a signal

A vulnerability was found in the Linux kernel's vsock subsystem's vsockstreamconnect function where improper handling of the socket state can lead to the connected table's list being corrupted. This occurs when a signal interrupt occurs and resets the socket's state without removing it from the...