Found 53 bookmarks
Newest
[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds
[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds
CVE-2025-37752 is an Array-Out-Of-Bounds vulnerability in the Linux network packet scheduler, specifically in the SFQ queuing discipline. An invalid SFQ limit and a series of interactions between SFQ and the TBF Qdisc can lead to a 0x0000 being written approximately 256KB out of bounds at a misaligned offset. If properly exploited, this can enable privilege escalation. Spray sfq_slots in kmalloc-64 to prevent an immediate kernel crash when the bug is triggered. Prevent a type-confused skb from being dequeued by reconfiguring the TBF Qdisc. Drop TBF rate and add packet overhead before the OOB write occurs. Use the 0x0000 written 262636 bytes OOB to corrupt the pipe->files field of a named pipe, free the pipe, cause page-level UAF and get arbitrary R/W in that page. Reclaim the freed page with signalfd files and use the page-level R/W primitive to swap file->private_data with file->f_cred. * Get root by overwriting the process credentials with zeros via signalfd4().bounds at a misaligned offset. If properly exploited, this can enable privilege escalation.
#syst3mfailure.io#EN#2025#CVE-2025-37752#kernelCTF#linux#kernel#pwn#exploit#oob#out-of-bounds#vulnerability
·syst3mfailure.io·
[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds
SSD Advisory - Linux kernel hfsplus slab-out-of-bounds Write - SSD Secure Disclosure
SSD Advisory - Linux kernel hfsplus slab-out-of-bounds Write - SSD Secure Disclosure
This advisory describes an out-of-bounds write vulnerability in the Linux kernel that achieves local privilege escalation on Ubuntu 22.04 for active user sessions. Credit An independent security researcher working with SSD Secure Disclosure. Vendor Response Ubuntu has released the following advisory and fix: https://ubuntu.com/security/CVE-2025-0927
#ssd-disclosure#EN#2025#CVE-2025-0927#Linux#kernel#hfsplus#slab-out-of-bounds#Write
·ssd-disclosure.com·
SSD Advisory - Linux kernel hfsplus slab-out-of-bounds Write - SSD Secure Disclosure
PS4/PS5: TheFloW discloses Kernel vulnerability relying on old bug from 2006, impacts PS4 up to 11.00 & PS5 up to 8.20, more details in May
PS4/PS5: TheFloW discloses Kernel vulnerability relying on old bug from 2006, impacts PS4 up to 11.00 & PS5 up to 8.20, more details in May
A few months ago, I wrote about a rumor that TheFloW‘s yet-to-be-disclosed PS4/PS5 Kernel exploit was relying on an 18 year old vulnerability. What sounded like an obvious troll initially, then looked more and...
#wololo#EN#2024#Sony#Playstation#Kernel#CVE-2006-4304
·wololo.net·
PS4/PS5: TheFloW discloses Kernel vulnerability relying on old bug from 2006, impacts PS4 up to 11.00 & PS5 up to 8.20, more details in May
GameOver(lay) - Local Privilege Escalation in Ubuntu Kernel
GameOver(lay) - Local Privilege Escalation in Ubuntu Kernel
GameOver(lay) encompasses two significant vulnerabilities within the Ubuntu kernel, CVE-2023-2640, and CVE-2023-32629, each carrying a high-severity rating with CVSS scores of 7.8. These vulnerabilities pose a critical threat, potentially affecting around 40% of Ubuntu users. The vulnerability lies within the OverlayFS module of the Ubuntu kernel, enabling a
#projectdiscovery#EN#2023#Ubuntu#kernel#CVE-2023-2640#CVE-2023-32629
·blog.projectdiscovery.io·
GameOver(lay) - Local Privilege Escalation in Ubuntu Kernel
[CVE-2023-42752] integer overflow in Linux kernel leading to exploitable memory access
[CVE-2023-42752] integer overflow in Linux kernel leading to exploitable memory access
I recently found an integer overflow in the Linux kernel, which leads to the kernel allocating skb_shared_info in the userspace, which is exploitable in systems without SMAP protection since skb_shared_info contains references to function pointers.
#seclists#EN#2023#CVE-2023-42752#integer#overflow#Linux#kernel
·seclists.org·
[CVE-2023-42752] integer overflow in Linux kernel leading to exploitable memory access
Reptile Malware Targeting Linux Systems
Reptile Malware Targeting Linux Systems
Reptile is an open-source kernel module rootkit that targets Linux systems and is publicly available on GitHub. [1] Rootkits are malware that possess the capability to conceal themselves or other malware. They primarily target files, processes, and network communications for their concealment. Reptile’s concealment capabilities include not only its own kernel module but also files, directories, file contents, processes, and network traffic. Unlike other rootkit malware that typically only provide concealment capabilities, Reptile goes a step further by offering a reverse...
#ASEC#EN#2023#Reptile#open-source#kernel#module#rootkit#Linux
·asec.ahnlab.com·
Reptile Malware Targeting Linux Systems
oss-sec: [CVE-2023-32233] Linux kernel use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary reads and writes in kernel memory
oss-sec: [CVE-2023-32233] Linux kernel use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary reads and writes in kernel memory
An issue has been discovered in the Linux kernel that can be abused by unprivileged local users to escalate privileges. The issue is about Netfilter nf_tables accepting some invalid updates to its configuration.
#seclists.org#EN#2023#CVE-2023-32233#Linux#Kernel#Netfilter#nf_tables#arbitrary#memory#vulnerability
·seclists.org·
oss-sec: [CVE-2023-32233] Linux kernel use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary reads and writes in kernel memory
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Netfilter is a framework in the Linux kernel for implementing various networking-related tasks with user-defined handlers. Netfilter provides various functions for packet filtering, network address translation and port translation, and packet logging. Netfilter represents a set of hooks that allow other kernel modules to register callback functions in the kernel’s networking stack.
#theori#EN#2022#exploit#Linux#mqueue#CVE-2022-32250#Kernel
·blog.theori.io·
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Netfilter is a framework in the Linux kernel for implementing various networking-related tasks with user-defined handlers. Netfilter provides various functions for packet filtering, network address translation and port translation, and packet logging. Netfilter represents a set of hooks that allow other kernel modules to register callback functions in the kernel’s networking stack.
#theori#EN#2022#exploit#Linux#mqueue#CVE-2022-32250#Kernel
·blog.theori.io·
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Netfilter is a framework in the Linux kernel for implementing various networking-related tasks with user-defined handlers. Netfilter provides various functions for packet filtering, network address translation and port translation, and packet logging. Netfilter represents a set of hooks that allow other kernel modules to register callback functions in the kernel’s networking stack.
#theori#EN#2022#exploit#Linux#mqueue#CVE-2022-32250#Kernel
·blog.theori.io·
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Put an io_uring on it: Exploiting the Linux Kernel - Blog |
Put an io_uring on it: Exploiting the Linux Kernel - Blog |
At Grapl we believe that in order to build the best defensive system we need to deeply understand attacker behaviors. As part of that goal we're investing in offensive security research. Keep up with our blog for new research on high risk vulnerabilities, exploitation, and advanced threat tactics.
#Graplsecurity#en#2022#0-day#Linux#kernel#exploit#redteam#research
·graplsecurity.com·
Put an io_uring on it: Exploiting the Linux Kernel - Blog |
Put an io_uring on it: Exploiting the Linux Kernel - Blog |
Put an io_uring on it: Exploiting the Linux Kernel - Blog |
At Grapl we believe that in order to build the best defensive system we need to deeply understand attacker behaviors. As part of that goal we're investing in offensive security research. Keep up with our blog for new research on high risk vulnerabilities, exploitation, and advanced threat tactics.
#Graplsecurity#en#2022#0-day#Linux#kernel#exploit#redteam#research
·graplsecurity.com·
Put an io_uring on it: Exploiting the Linux Kernel - Blog |
Put an io_uring on it: Exploiting the Linux Kernel - Blog |
Put an io_uring on it: Exploiting the Linux Kernel - Blog |
At Grapl we believe that in order to build the best defensive system we need to deeply understand attacker behaviors. As part of that goal we're investing in offensive security research. Keep up with our blog for new research on high risk vulnerabilities, exploitation, and advanced threat tactics.
#Graplsecurity#en#2022#0-day#Linux#kernel#exploit#redteam#research
·graplsecurity.com·
Put an io_uring on it: Exploiting the Linux Kernel - Blog |