CVE-2017-5123

CVE-2017-5123 PoC CVE-2017-5123 - LPE - Bypasando SMEP/SMAP. Sin KASLR La implementación de waitid en los kernels upstream no restringía el destino objetivo para copiar los resultados de la información. Esto puede permitir a los usuarios locales escribir en memoria del kernel de otro modo...

cve-2017-5123

CVE-2017-5123 Questa repository contiene una dimostrazione di CVE-2017-5123 , un backdoor di comando e controllo via ICMP, e un'applicazione web vulnerabile CWE-78 OS Command Injection. Parte di CSC 4308 - Challenge 3. Prerequisiti Linux Kernel : dalla 4.13 fino alla ma esclusa 4.13.7 Node.js :...

CVE-2017-5123

README ملاحظة : الكود الموجود في هذا المستودع مخصص لعرض عزل تقنيات حاويات الرمل الآمنة مثل kata containers ولا يقصد مهاجمة أي منصات. كيفية إعادة الإنتاج احصل على نواة لينكس 4.13.0 طبّق الرقعة 0001-CVE-2017-5123-help-to-make-attack-safely.patch ابنِ نواة لينكس باستخدام الإعداد Kconfig أقلع النواة...

CVE-2017-5123

CVE-2017-5123 Escalade de privilèges sous Linux exploitant l'appel système waitid. Cet exploit vous est présenté par @XeR0x2A et @chaignc de HexpressoTeam à des fins éducatives uniquement. Le bogue a été introduit le 2017-05-21 et corrigé le 2017-10-09 ; 4.14.0-rc4+ est connu comme vulnérable...

CVE-2017-16994

/ disablemapminadd.c / / / include include include include include include include / Die Offsets können abweichen, der Kernel wurde individuell kompiliert. Beim Testen kannst du vmlinux lesen und den Offset berechnen. / / define OFFSETKERNELBASE 0x000000 / define MMAPMINADDR 0x1101de8 define...

CVE-2017-5123

CVE-2017-5123 نظرة عامة على الثغرة استدعاء النظام waitid في نواة لينكس لم يتحقق من صحة العنوان الهدف المستخدم. قد يسمح هذا لمستخدم محلي بالكتابة في ذاكرة النواة، مما قد يؤدي إلى تصعيد الامتيازات على الجهاز أو الهروب من وضع الحماية. وصف الثغرة تصنيف الثغرة تصعيد الامتيازات الهروب من وضع الحماية...

exploit_linux_kernel4.13

Questo repository contiene un vecchio poc che combina tre CVE CVE-2017-14954, CVE-2017-18344, CVE-2017-5123. Il poc è un'Elevazione locale dei privilegi per Linux Kernel 4.13 testato su Ubuntu. L'exploit utilizza una fuga di informazioni CVE-2017-14954 per bypassare KASLR, una lettura arbitraria...

CVE-2026-49424

The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...

CVE-2026-49424

CVE-2026-49424 affects the Linux compatibility layer (Linuxulator, module linux(4)) in FreeBSD 14.3, 14.4, and 15.0 . The waitid() system call implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t without first zeroing it, allowing an unprivileged user to obse...

CVE-2026-49424 Kernel stack disclosure in Linux compatibility layer

The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...

EUVD-2026-62345

The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...

The vulnerability in the implementation of the waitid() system call layer of the Linuxulator kernel in FreeBSD allows a attacker to disclose protected information.

The vulnerability in the implementation of the waitid system call layer of the Linuxulator kernel in FreeBSD operating systems is related to the use of an uninitialized variable. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security...

FreeBSD-SA-26:47.linux

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:47.linux Security Advisory The FreeBSD Project Topic: Kernel stack disclosure in Linux compatibility layer Category: core Module: linux4 Announced: 2026-06-3...

FreeBSD -- Kernel stack disclosure in Linux compatibility layer

Problem Description: The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. Impact: An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: Clear the waitid information before copying it to userspace. The IORINGOPWAITID structure stores its result fields in the struct iowaitid::info structure, and later copies these fields to the userspace siginfo...

SUSE CVE-2026-46315

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: clear waitid info before copying it to userspace IORINGOPWAITID stores its result fields in struct iowaitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it...

CVE-2026-46315

A flaw was found in the Linux kernel's iouring subsystem, specifically within the IORINGOPWAITID operation. This vulnerability occurs because the waitid information structure is not properly initialized before being copied to userspace. A local user could exploit this to expose stale data from...

CVE-2026-46315

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: clear waitid info before copying it to userspace IORINGOPWAITID stores its result fields in struct iowaitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it...

UBUNTU-CVE-2026-46315

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: clear waitid info before copying it to userspace IORINGOPWAITID stores its result fields in struct iowaitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it...

EUVD-2026-35373

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: clear waitid info before copying it to userspace IORINGOPWAITID stores its result fields in struct iowaitid::info and later copies them to userspace siginfo. The prep path initializes the request arguments, but it...