tag
C
Sudo `chroot` Option Local Privilege Escalation (CVE-2025-32463)
Sudo's -R/--chroot option allowed an unprivileged local user to make sudo chroot() into a directory the user controls before sudo resolves and loads NSS (Name Service Switch) configuration and modules. Because sudo continues to consult /etc/nsswitch.conf and…
IngressNightmare: Kubernetes ingress-nginx Admission Controller Shared-Library Injection RCE (CVE-2025-1974)
The ingress-nginx admission controller validates incoming Ingress objects by rendering a temporary NGINX configuration and running nginx -t against it — but the validation webhook itself has no authentication and accepts attacker-controlled configuration…
FreeBSD OSS /dev/dsp Stale Kernel-Stack Buffer Local Privilege Escalation (CVE-2026-49417)
exp.c is a local FreeBSD kernel privilege-escalation exploit built around /dev/dsp (the OSS sound driver). It sprays hundreds of pthreads that call nanosleep() with distinctively tagged tvnsec values so their kernel stacks/return addresses are recognizable,…
FreeBSD Linuxulator AT_SECURE=0 Local Privilege Escalation via LD_PRELOAD (CVE-2026-49413)
exploit.c is a local privilege-escalation PoC targeting FreeBSD's Linux compatibility subsystem. It detects whether the Linuxulator is loaded and glibc's dynamic linker is present under /compat/linux/, locates a setuid-root Linux binary within that tree, and…
Linux Kernel act_pedit Partial COW Page-Cache LPE (CVE-2026-46331)
CVE-2026-46331 is a local privilege escalation in the Linux kernel's net/sched/actpedit subsystem. The vulnerable function tcfpeditact() computes the writable Copy-on-Write (COW) region using a pre-calculated maximum hint (tcfpoffmaxhint) before the actual…
libssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)
CVE-2026-55200 is a critical heap out-of-bounds write in libssh2's SSH transport layer (ssh2transportread() in src/transport.c). The function validates that packetlength is greater than zero but performs no upper-bound check, allowing an attacker-controlled…
libcurl mTLS Connection Reuse Authentication Bypass (CVE-2026-8932)
CVE-2026-8932 is a Low-severity authentication bypass in libcurl's TLS connection reuse logic. Certain mTLS private-key configuration parameters (key file path, key type, key password) were omitted from the connection-matching comparison performed when…
DirtyClone — Linux Kernel LPE via Cloned Packet Page-Cache Overwrite (CVE-2026-43503)
DirtyClone (CVE-2026-43503, CVSS 8.8) is the fourth member of the DirtyFrag family of Linux kernel local privilege escalation vulnerabilities. Each member shares the same root failure: file-backed page-cache memory is exposed to network packet operations, and…