{ "generated_at": "2026-07-14T07:52:02.183Z", "source_generated_at": "2026-07-04T15:22:46.617Z", "source_url": "https://github.com/xairy/linux-kernel-exploitation", "scope": { "min_cve_year": 2020, "max_valid_cve_year": 2027, "rule": "CVE identifier year >= 2020; article publication year is not used for inclusion" }, "reconciliation": { "url_nodes": { "total": 1711, "qualifying_2020_plus": 366, "pre_2020_only": 148, "cve_unknown_only": 30, "malformed_cve": 2, "no_cve": 1165, "sum": 1711 }, "research_items": { "total": 1320, "qualifying_2020_plus": 289, "pre_2020_only": 135, "cve_unknown_only": 24, "malformed_cve": 2, "no_cve": 870, "sum": 1320 } }, "malformed_cves": [ "CVE-2106-2504" ], "cve_group_count": 243, "item_cve_association_count": 351, "url_cve_association_count": 467, "component_counts": [ { "id": "other", "label": "Other / needs triage", "location": "location not resolved from source titles", "cve_count": 69, "discussion_count": 78 }, { "id": "network", "label": "Network protocols / sockets", "location": "net/", "cve_count": 41, "discussion_count": 52 }, { "id": "mobile-gpu", "label": "Mobile GPU / IOMMU", "location": "drivers/gpu/ + vendor GPU drivers", "cve_count": 23, "discussion_count": 35 }, { "id": "mobile-soc", "label": "Mobile SoC / accelerator drivers", "location": "vendor drivers (NPU, DSP, camera, xPU)", "cve_count": 22, "discussion_count": 28 }, { "id": "io-uring", "label": "Async I/O / io_uring", "location": "io_uring/", "cve_count": 12, "discussion_count": 21 }, { "id": "netfilter", "label": "Netfilter / nftables", "location": "net/netfilter/", "cve_count": 12, "discussion_count": 22 }, { "id": "filesystem", "label": "Filesystems / VFS / storage", "location": "fs/ + block/ + drivers/nvme/", "cve_count": 11, "discussion_count": 16 }, { "id": "memory", "label": "Memory / page cache", "location": "mm/ + fs/pipe.c", "cve_count": 11, "discussion_count": 35 }, { "id": "drivers", "label": "Device drivers / TTY / USB / TEE", "location": "drivers/", "cve_count": 10, "discussion_count": 12 }, { "id": "ebpf", "label": "eBPF / verifier", "location": "kernel/bpf/ + net/core/filter.c", "cve_count": 9, "discussion_count": 11 }, { "id": "core-kernel", "label": "Core kernel / task lifetime", "location": "kernel/ + fs/exec.c", "cve_count": 8, "discussion_count": 14 }, { "id": "net-sched", "label": "Network scheduler", "location": "net/sched/", "cve_count": 5, "discussion_count": 8 }, { "id": "android-ipc", "label": "Android IPC / Binder", "location": "drivers/android/", "cve_count": 4, "discussion_count": 11 }, { "id": "architecture", "label": "CPU architecture / side channels", "location": "arch/", "cve_count": 4, "discussion_count": 5 }, { "id": "virtualization", "label": "Virtualization / containers", "location": "virt/ + arch/*/kvm/", "cve_count": 2, "discussion_count": 3 } ], "android_priority_counts": { "review": 140, "confirmed": 37, "high": 33, "low": 33 }, "cve_year_counts": { "2020": 17, "2021": 40, "2022": 38, "2023": 55, "2024": 46, "2025": 37, "2026": 10 }, "groups": [ { "cve": "CVE-2026-31431", "year": 2026, "name": "Copy Fail", "named_from_title": true, "name_source_title": "Copy Fail", "discussion_count": 10, "resource_count": 15, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "memory management or page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "c3f391c0dfc7d3e6", "title": "0xBruno/CopyOverlayFail", "year": 2026, "authors": [], "primary_url": "https://github.com/0xBruno/CopyOverlayFail", "summary_zh": "一个针对CVE-2026-31431（Copy Overlay Fail）的漏洞利用库。", "summary_en": "A repository for exploiting CVE-2026-31431 with a focus on Copy Overlay Fail.", "source_markdown": "https://github.com/0xBruno/CopyOverlayFail [CVE-2026-31431] [Copy Fail]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/0xBruno/CopyOverlayFail", "raw_path": "/raw/2026-exploits-0xbruno-copyoverlayfail-primary-e259f22e.txt" } ] }, { "item_id": "1e04d46cdf369c35", "title": "AF_ALG page-cache cross-container pivot: Part I", "year": 2026, "authors": [ "Massimiliano Oldani" ], "primary_url": "https://www.linkedin.com/pulse/afalg-page-cache-cross-container-pivot-part-i-massimiliano-oldani-jgfyf/", "summary_zh": "AF_ALG page-cache 跨容器转移探讨了 Copy Fail 漏洞的一个变种。", "summary_en": "AF_ALG page-cache cross-container pivot explores a variant of the Copy Fail vulnerability.", "source_markdown": "[2026: \"AF_ALG page-cache cross-container pivot: Part I\" by Massimiliano Oldani](https://www.linkedin.com/pulse/afalg-page-cache-cross-container-pivot-part-i-massimiliano-oldani-jgfyf/) [article] [[exploit](https://github.com/sgkdev/page_inject/)] [CVE-2026-31431] [Copy Fail]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.linkedin.com/pulse/afalg-page-cache-cross-container-pivot-part-i-massimiliano-oldani-jgfyf/", "raw_path": "/raw/2026-vulnerabilities-lpe-af-alg-page-cache-cross-container-pivot-part-i-primary-30cd803e.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/sgkdev/page_inject/", "raw_path": "/raw/2026-vulnerabilities-lpe-af-alg-page-cache-cross-container-pivot-part-i-exploit-23593e06.txt" } ] }, { "item_id": "e279351ef8493195", "title": "badsectorlabs/copyfail-go", "year": 2026, "authors": [], "primary_url": "https://github.com/badsectorlabs/copyfail-go", "summary_zh": "另一个针对CVE-2026-31431（Copy Fail）的漏洞利用库。", "summary_en": "Another repository for exploiting CVE-2026-31431 with Copy Fail focus.", "source_markdown": "https://github.com/badsectorlabs/copyfail-go [CVE-2026-31431] [Copy Fail]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/badsectorlabs/copyfail-go", "raw_path": "/raw/2026-exploits-badsectorlabs-copyfail-go-primary-d5053fca.txt" } ] }, { "item_id": "a40c241149a7c6c1", "title": "Copy Fail", "year": 2026, "authors": [], "primary_url": "https://copy.fail/", "summary_zh": "该摘要讨论了影响Linux发行版的Copy Fail漏洞（CVE-2026-31431）。", "summary_en": "The summary discusses the Copy Fail vulnerability (CVE-2026-31431) affecting Linux distributions.", "source_markdown": "[2026: \"Copy Fail\"](https://copy.fail/) [summary] [[article](https://xint.io/blog/copy-fail-linux-distributions)] [[exploit](https://github.com/theori-io/copy-fail-CVE-2026-31431)] [CVE-2026-31431]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "summary", "url": "https://copy.fail/", "raw_path": "/raw/2026-vulnerabilities-lpe-copy-fail-primary-c7b0053b.txt" }, { "label": "article", "type": "article", "url": "https://xint.io/blog/copy-fail-linux-distributions", "raw_path": "/raw/2026-vulnerabilities-lpe-copy-fail-article-daedc65c.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/theori-io/copy-fail-CVE-2026-31431", "raw_path": "/raw/2026-vulnerabilities-lpe-copy-fail-exploit-9c342c7f.txt" } ] }, { "item_id": "5d7a74dbc8ab17a6", "title": "Copy Fail: A 4-Byte Page-Cache Write LPE", "year": 2026, "authors": [ "Axura" ], "primary_url": "https://4xura.com/binex/kernel/copy-fail/", "summary_zh": "本文讨论了 Copy Fail 漏洞及其影响。", "summary_en": "This article discusses the Copy Fail vulnerability and its implications.", "source_markdown": "[2026: \"Copy Fail: A 4-Byte Page-Cache Write LPE\" by Axura](https://4xura.com/binex/kernel/copy-fail/) [article] [[exploit](https://github.com/4xura/CVE-2026-31431-Copy-Fail)] [CVE-2026-31431] [Copy Fail]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://4xura.com/binex/kernel/copy-fail/", "raw_path": "/raw/2026-vulnerabilities-lpe-copy-fail-a-4-byte-page-cache-write-lpe-primary-3fd89047.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/4xura/CVE-2026-31431-Copy-Fail", "raw_path": "/raw/2026-vulnerabilities-lpe-copy-fail-a-4-byte-page-cache-write-lpe-exploit-16e0f099.txt" } ] }, { "item_id": "1c32a4d49eb7ec5b", "title": "Copy Fail: From Pod to Host.", "year": 2026, "authors": [ "Juno Im" ], "primary_url": "https://xint.io/blog/copy-fail-pod-to-host", "summary_zh": "Copy Fail: 从 Pod 到 Host 讨论了 Kubernetes 中的权限提升技术。", "summary_en": "Copy Fail: From Pod to Host discusses privilege escalation techniques in Kubernetes.", "source_markdown": "[2026: \"Copy Fail: From Pod to Host.\" by Juno Im](https://xint.io/blog/copy-fail-pod-to-host) [article] [[exploit](https://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC)] [CVE-2026-31431] [Copy Fail]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://xint.io/blog/copy-fail-pod-to-host", "raw_path": "/raw/2026-vulnerabilities-lpe-copy-fail-from-pod-to-host-primary-b39473f4.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC", "raw_path": "/raw/2026-vulnerabilities-lpe-copy-fail-from-pod-to-host-exploit-16ac8b1f.txt" } ] }, { "item_id": "e2fa6def5df2e119", "title": "CVE-2026-31431: Copy Fail", "year": 2026, "authors": [ "Jorge Buzeti" ], "primary_url": "https://retr0.zip/blog/cve-2026-31431-copy-fail.html", "summary_zh": "CVE-2026-31431 详细描述了 Linux 内核中的 Copy Fail 漏洞。", "summary_en": "CVE-2026-31431 details the Copy Fail vulnerability in the Linux kernel.", "source_markdown": "[2026: \"CVE-2026-31431: Copy Fail\" by Jorge Buzeti](https://retr0.zip/blog/cve-2026-31431-copy-fail.html) [article] [CVE-2026-31431] [Copy Fail]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://retr0.zip/blog/cve-2026-31431-copy-fail.html", "raw_path": "/raw/2026-vulnerabilities-lpe-cve-2026-31431-copy-fail-primary-56a76d98.txt" } ] }, { "item_id": "91c1852772210ebe", "title": "d7b5d0599b154c9ec83c182acbd56e8b", "year": 2026, "authors": [], "primary_url": "https://gist.github.com/blasty/d7b5d0599b154c9ec83c182acbd56e8b", "summary_zh": "一个用于利用CVE-2026-31431的代码库。", "summary_en": "A code repository for exploiting CVE-2026-31431.", "source_markdown": "https://gist.github.com/blasty/d7b5d0599b154c9ec83c182acbd56e8b [CVE-2026-31431] [Copy Fail]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://gist.github.com/blasty/d7b5d0599b154c9ec83c182acbd56e8b", "raw_path": "/raw/2026-exploits-d7b5d0599b154c9ec83c182acbd56e8b-primary-1ca37bfb.txt" } ] }, { "item_id": "fdc4c8626de556c7", "title": "rootsecdev/cve_2026_31431", "year": 2026, "authors": [], "primary_url": "https://github.com/rootsecdev/cve_2026_31431", "summary_zh": "一个针对CVE-2026-31431（Copy Fail）的漏洞利用库。", "summary_en": "A repository for exploiting CVE-2026-31431 with a focus on Copy Fail.", "source_markdown": "https://github.com/rootsecdev/cve_2026_31431 [CVE-2026-31431] [Copy Fail]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/rootsecdev/cve_2026_31431", "raw_path": "/raw/2026-exploits-rootsecdev-cve-2026-31431-primary-75356607.txt" } ] }, { "item_id": "afda8ae4788ba550", "title": "tgies/copy-fail-c", "year": 2026, "authors": [], "primary_url": "https://github.com/tgies/copy-fail-c", "summary_zh": "一个用于利用C语言的CVE-2026-31431的库。", "summary_en": "A repository for exploiting CVE-2026-31431 in C language.", "source_markdown": "https://github.com/tgies/copy-fail-c [CVE-2026-31431] [Copy Fail]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/tgies/copy-fail-c", "raw_path": "/raw/2026-exploits-tgies-copy-fail-c-primary-15ba1edd.txt" } ] } ], "rank": 1 }, { "cve": "CVE-2022-0847", "year": 2022, "name": "Dirty Pipe", "named_from_title": true, "name_source_title": "Escaping containers using the Dirty Pipe vulnerability", "discussion_count": 10, "resource_count": 13, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "pipe buffers and page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025, 2022 ], "items": [ { "item_id": "ab5ae84e5ec34d7d", "title": "DirtyPipe-CVE-2022-0847", "year": 2025, "authors": [ "Abdul Qadir" ], "primary_url": "https://0xnull007.github.io/posts/dirtypipe-cve-2022-0847", "summary_zh": "关于DirtyPipe漏洞的文章，该漏洞允许在Linux中进行本地特权升级。", "summary_en": "An article on the DirtyPipe vulnerability, which allows local privilege escalation in Linux.", "source_markdown": "[2025: \"DirtyPipe-CVE-2022-0847\" by Abdul Qadir](https://0xnull007.github.io/posts/dirtypipe-cve-2022-0847) [article] [CVE-2022-0847]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://0xnull007.github.io/posts/dirtypipe-cve-2022-0847", "raw_path": "/raw/2025-vulnerabilities-lpe-dirtypipe-cve-2022-0847-primary-63b34527.txt" } ] }, { "item_id": "d5c912cc7a0b9450", "title": "Arinerron/CVE-2022-0847-DirtyPipe-Exploit", "year": 2022, "authors": [], "primary_url": "https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit", "summary_zh": "CVE-2022-0847（DirtyPipe）漏洞的利用代码。", "summary_en": "Exploit code for CVE-2022-0847 (DirtyPipe) vulnerability.", "source_markdown": "https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "exploit", "url": "https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit", "raw_path": "/raw/2022-exploits-arinerron-cve-2022-0847-dirtypipe-exploit-primary-d7a244d6.txt" } ] }, { "item_id": "7af0295b000d1537", "title": "DirtyPipe-Android/TECHNICAL-DETAILS.md", "year": 2022, "authors": [ "polygraphene" ], "primary_url": "https://github.com/polygraphene/DirtyPipe-Android/blob/master/TECHNICAL-DETAILS.md", "summary_zh": "关于Android中Dirty Pipe漏洞的技术细节。", "summary_en": "Technical details on the Dirty Pipe vulnerability in Android.", "source_markdown": "[2022: \"DirtyPipe-Android/TECHNICAL-DETAILS.md\" by polygraphene](https://github.com/polygraphene/DirtyPipe-Android/blob/master/TECHNICAL-DETAILS.md) [article] [CVE-2022-0847]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/polygraphene/DirtyPipe-Android/blob/master/TECHNICAL-DETAILS.md", "raw_path": "/raw/2022-vulnerabilities-lpe-dirtypipe-android-technical-details-md-primary-d154460b.txt" } ] }, { "item_id": "e45b46a069e9a4a8", "title": "Escaping containers using the Dirty Pipe vulnerability", "year": 2022, "authors": [ "Eric Mountain et. al" ], "primary_url": "https://securitylabs.datadoghq.com/articles/dirty-pipe-container-escape-poc/", "summary_zh": "本文介绍了Dirty Pipe漏洞及其在容器逃逸中的利用。", "summary_en": "This article covers the Dirty Pipe vulnerability and its exploitation for container escapes.", "source_markdown": "[2022: \"Escaping containers using the Dirty Pipe vulnerability\" by Eric Mountain et. al](https://securitylabs.datadoghq.com/articles/dirty-pipe-container-escape-poc/) [article] [CVE-2022-0847]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://securitylabs.datadoghq.com/articles/dirty-pipe-container-escape-poc/", "raw_path": "/raw/2022-vulnerabilities-lpe-escaping-containers-using-the-dirty-pipe-vulnerability-primary-fa0fec14.txt" } ] }, { "item_id": "87d15ca194b01293", "title": "Exploration of the Dirty Pipe Vulnerability (CVE-2022-0847)", "year": 2022, "authors": [ "lolcads" ], "primary_url": "https://lolcads.github.io/posts/2022/06/dirty_pipe_cve_2022_0847/", "summary_zh": "对Linux内核中Dirty Pipe漏洞的探讨。", "summary_en": "An exploration of the Dirty Pipe vulnerability in the Linux kernel.", "source_markdown": "[2022: \"Exploration of the Dirty Pipe Vulnerability (CVE-2022-0847)\" by lolcads](https://lolcads.github.io/posts/2022/06/dirty_pipe_cve_2022_0847/) [article] [CVE-2022-0847]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://lolcads.github.io/posts/2022/06/dirty_pipe_cve_2022_0847/", "raw_path": "/raw/2022-vulnerabilities-lpe-exploration-of-the-dirty-pipe-vulnerability-cve-2022-0847-primary-947da6e7.txt" } ] }, { "item_id": "797595038dd3389c", "title": "How we use Dirty Pipe to get reverse root shell on Android Emulator and Pixel 6", "year": 2022, "authors": [ "LiN", "YingMuo" ], "primary_url": "https://hitcon.org/2022/slides/How%20we%20use%20Dirty%20Pipe%20to%20get%20reverse%20root%20shell%20on%20Android%20Emulator%20and%20Pixel%206.pdf", "summary_zh": "关于在Android设备上利用Dirty Pipe进行权限提升的幻灯片。", "summary_en": "Slides detailing the use of Dirty Pipe for privilege escalation on Android devices.", "source_markdown": "[2022: \"How we use Dirty Pipe to get reverse root shell on Android Emulator and Pixel 6\" by LiN and YingMuo](https://hitcon.org/2022/slides/How%20we%20use%20Dirty%20Pipe%20to%20get%20reverse%20root%20shell%20on%20Android%20Emulator%20and%20Pixel%206.pdf) [slides] [[video](https://www.youtube.com/watch?v=gyku4QyV5eM)] [CVE-2022-0847]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://hitcon.org/2022/slides/How%20we%20use%20Dirty%20Pipe%20to%20get%20reverse%20root%20shell%20on%20Android%20Emulator%20and%20Pixel%206.pdf", "raw_path": "/raw/2022-vulnerabilities-lpe-how-we-use-dirty-pipe-to-get-reverse-root-shell-on-android-emulator-and-pixel-6-prima.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=gyku4QyV5eM", "raw_path": "/raw/2022-vulnerabilities-lpe-how-we-use-dirty-pipe-to-get-reverse-root-shell-on-android-emulator-and-pixel-6-video.txt" } ] }, { "item_id": "fd22935af71576b7", "title": "Learning Linux kernel exploitation", "year": 2022, "authors": [ "0x434b" ], "primary_url": "https://0x434b.dev/dabbling-with-linux-kernel-exploitation-ctf-challenges-to-learn-the-ropes/", "summary_zh": "2022 年 Linux 内核Technique: Exploitation资料：「Learning Linux kernel exploitation」（CVE-2022-0847）；URL 类型：article。", "summary_en": "2022 Linux kernel Technique: Exploitation resource \"Learning Linux kernel exploitation\" (CVE-2022-0847); URL type: article.", "source_markdown": "[2022: \"Learning Linux kernel exploitation\" by 0x434b](https://0x434b.dev/dabbling-with-linux-kernel-exploitation-ctf-challenges-to-learn-the-ropes/) [article] [[part 2](https://0x434b.dev/learning-linux-kernel-exploitation-part-2-cve-2022-0847/)]", "affected_area": "", "android_status": "no", "android_confirmed": false, "android_reason": "Not enough evidence that this resource maps to released Android devices.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://0x434b.dev/dabbling-with-linux-kernel-exploitation-ctf-challenges-to-learn-the-ropes/", "raw_path": "/raw/2022-techniques-exploitation-learning-linux-kernel-exploitation-primary-803aa8cb.txt" }, { "label": "part 2", "type": "article", "url": "https://0x434b.dev/learning-linux-kernel-exploitation-part-2-cve-2022-0847/", "raw_path": "/raw/2022-techniques-exploitation-learning-linux-kernel-exploitation-part-2-eabbc91a.txt" } ] }, { "item_id": "42034ee0e649eb26", "title": "polygraphene/DirtyPipe-Android", "year": 2022, "authors": [], "primary_url": "https://github.com/polygraphene/DirtyPipe-Android", "summary_zh": "一个用于利用CVE-2022-0847（DirtyPipe）的代码库。", "summary_en": "A code repository for exploiting CVE-2022-0847 known as DirtyPipe.", "source_markdown": "https://github.com/polygraphene/DirtyPipe-Android [CVE-2022-0847]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/polygraphene/DirtyPipe-Android", "raw_path": "/raw/2022-exploits-polygraphene-dirtypipe-android-primary-8e24e759.txt" } ] }, { "item_id": "8d51341138656b4d", "title": "The Dirty Pipe Vulnerability", "year": 2022, "authors": [ "Max Kellermann" ], "primary_url": "https://dirtypipe.cm4all.com/", "summary_zh": "Dirty Pipe漏洞(CVE-2022-0847)对本地权限提升构成重大风险。", "summary_en": "The Dirty Pipe vulnerability (CVE-2022-0847) poses a significant risk for local privilege escalation.", "source_markdown": "[2022: \"The Dirty Pipe Vulnerability\" by Max Kellermann](https://dirtypipe.cm4all.com/) [article] [CVE-2022-0847]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://dirtypipe.cm4all.com/", "raw_path": "/raw/2022-vulnerabilities-lpe-the-dirty-pipe-vulnerability-primary-2e26e836.txt" } ] }, { "item_id": "2706950ffec61408", "title": "Weaponizing dirtypipe on android", "year": 2022, "authors": [ "Giovanni Rocca" ], "primary_url": "https://docs.google.com/presentation/d/1Tq00gy1GtiK0OvNYOy_kCz0er9ZECBXGoy5Lfy5MD3M/edit?usp=sharing", "summary_zh": "关于在Android上武器化Dirty Pipe漏洞的幻灯片。", "summary_en": "Slides on weaponizing the Dirty Pipe vulnerability on Android.", "source_markdown": "[2022: \"Weaponizing dirtypipe on android\" by Giovanni Rocca](https://docs.google.com/presentation/d/1Tq00gy1GtiK0OvNYOy_kCz0er9ZECBXGoy5Lfy5MD3M/edit?usp=sharing) [slides] [[exploit](https://github.com/iGio90/DirtyPipeZ)] [CVE-2022-0847]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "slides", "url": "https://docs.google.com/presentation/d/1Tq00gy1GtiK0OvNYOy_kCz0er9ZECBXGoy5Lfy5MD3M/edit?usp=sharing", "raw_path": "/raw/2022-vulnerabilities-lpe-weaponizing-dirtypipe-on-android-primary-cf0687f4.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/iGio90/DirtyPipeZ", "raw_path": "/raw/2022-vulnerabilities-lpe-weaponizing-dirtypipe-on-android-exploit-c3ef9997.txt" } ] } ], "rank": 2 }, { "cve": "CVE-2024-0582", "year": 2024, "name": "Exploiting CVE-2024-0582 via the Dirty Pagetable Method", "named_from_title": false, "name_source_title": "Exploiting CVE-2024-0582 via the Dirty Pagetable Method", "discussion_count": 6, "resource_count": 6, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "provided-buffer ring", "kernel_location": "io_uring/", "component_confidence": "high", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2026, "article_years": [ 2026, 2025, 2024 ], "items": [ { "item_id": "61f8f5545d2850fa", "title": "CVE-2024-0582, or Easy Kernel Exploitation", "year": 2026, "authors": [ "Moe Acherir" ], "primary_url": "https://mohandacherir.github.io/Qdiv7/posts/n-day-exploit-cve-2024/", "summary_zh": "这篇文章涵盖了被识别为CVE-2024-0582的简单内核利用漏洞。", "summary_en": "This article covers an easy kernel exploitation vulnerability identified as CVE-2024-0582.", "source_markdown": "[2026: \"CVE-2024-0582, or Easy Kernel Exploitation\" by Moe Acherir](https://mohandacherir.github.io/Qdiv7/posts/n-day-exploit-cve-2024/) [article] [CVE-2024-0582]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://mohandacherir.github.io/Qdiv7/posts/n-day-exploit-cve-2024/", "raw_path": "/raw/2026-vulnerabilities-lpe-cve-2024-0582-or-easy-kernel-exploitation-primary-6a04f411.txt" } ] }, { "item_id": "20a2fbef2af3dd9f", "title": "A Series of io_uring pbuf Vulnerabilities", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/03/02/a-series-of-io_uring-pbuf-vulnerabilities.html", "summary_zh": "本文讨论了与Linux内核io_uring pbuf相关的一系列漏洞。", "summary_en": "This article discusses a series of vulnerabilities related to io_uring pbuf in the Linux kernel.", "source_markdown": "[2025: \"A Series of io_uring pbuf Vulnerabilities\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/03/02/a-series-of-io_uring-pbuf-vulnerabilities.html) [article] [CVE-2024-0582] [CVE-2024-35880] [CVE-UNKNOWN]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/03/02/a-series-of-io_uring-pbuf-vulnerabilities.html", "raw_path": "/raw/2025-vulnerabilities-other-a-series-of-io-uring-pbuf-vulnerabilities-primary-50c4d67e.txt" } ] }, { "item_id": "12ab84e623381017", "title": "Exploiting CVE-2024-0582 via the Dirty Pagetable Method", "year": 2025, "authors": [ "Kuzey Arda Bulut" ], "primary_url": "https://kuzey.rs/posts/Dirty_Page_Table/", "summary_zh": "2025 年 Linux 内核LPE资料：「Exploiting CVE-2024-0582 via the Dirty Pagetable Method」（CVE-2024-0582）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"Exploiting CVE-2024-0582 via the Dirty Pagetable Method\" (CVE-2024-0582); URL type: article.", "source_markdown": "[2025: \"Exploiting CVE-2024-0582 via the Dirty Pagetable Method\" by Kuzey Arda Bulut](https://kuzey.rs/posts/Dirty_Page_Table/) [article] [CVE-2024-0582]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://kuzey.rs/posts/Dirty_Page_Table/", "raw_path": "/raw/2025-vulnerabilities-lpe-exploiting-cve-2024-0582-via-the-dirty-pagetable-method-primary-4b3442e8.txt" } ] }, { "item_id": "5350f7686aac9bdb", "title": "kuzeyardabulut/CVE-2024-0582", "year": 2024, "authors": [], "primary_url": "https://github.com/kuzeyardabulut/CVE-2024-0582", "summary_zh": "一个针对CVE-2024-0582的漏洞利用库。", "summary_en": "An exploit repository for CVE-2024-0582.", "source_markdown": "https://github.com/kuzeyardabulut/CVE-2024-0582", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/kuzeyardabulut/CVE-2024-0582", "raw_path": "/raw/2024-exploits-kuzeyardabulut-cve-2024-0582-primary-5e6a0941.txt" } ] }, { "item_id": "9a8be4f71f2254a3", "title": "Mind the Patch Gap: Exploiting an io_uring Vulnerability in Ubuntu", "year": 2024, "authors": [ "Oriol Castejon" ], "primary_url": "https://blog.exodusintel.com/2024/03/27/mind-the-patch-gap-exploiting-an-io_uring-vulnerability-in-ubuntu/", "summary_zh": "2024 年 Linux 内核LPE资料：「Mind the Patch Gap: Exploiting an io_uring Vulnerability in Ubuntu」（CVE-2024-0582）；URL 类型：article。", "summary_en": "2024 Linux kernel LPE resource \"Mind the Patch Gap: Exploiting an io_uring Vulnerability in Ubuntu\" (CVE-2024-0582); URL type: article.", "source_markdown": "[2024: \"Mind the Patch Gap: Exploiting an io_uring Vulnerability in Ubuntu\" by Oriol Castejon](https://blog.exodusintel.com/2024/03/27/mind-the-patch-gap-exploiting-an-io_uring-vulnerability-in-ubuntu/) [CVE-2024-0582]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.exodusintel.com/2024/03/27/mind-the-patch-gap-exploiting-an-io_uring-vulnerability-in-ubuntu/", "raw_path": "/raw/2024-vulnerabilities-lpe-mind-the-patch-gap-exploiting-an-io-uring-vulnerability-in-ubuntu-primary-c2e39284.txt" } ] }, { "item_id": "99c27882a7ef6d67", "title": "ysanatomic/io_uring_LPE-CVE-2024-0582", "year": 2024, "authors": [], "primary_url": "https://github.com/ysanatomic/io_uring_LPE-CVE-2024-0582", "summary_zh": "2024 年 Linux 内核Exploits资料：「ysanatomic/io_uring_LPE-CVE-2024-0582」（CVE-2024-0582）；URL 类型：code。", "summary_en": "2024 Linux kernel Exploits resource \"ysanatomic/io_uring_LPE-CVE-2024-0582\" (CVE-2024-0582); URL type: code.", "source_markdown": "https://github.com/ysanatomic/io_uring_LPE-CVE-2024-0582", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/ysanatomic/io_uring_LPE-CVE-2024-0582", "raw_path": "/raw/2024-exploits-ysanatomic-io-uring-lpe-cve-2024-0582-primary-60a7fd10.txt" } ] } ], "rank": 3 }, { "cve": "CVE-2022-32250", "year": 2022, "name": "Conquering a Use-After-Free in nf_tables: Detailed Analysis and Exploitation of CVE-2022-32250", "named_from_title": false, "name_source_title": "Conquering a Use-After-Free in nf_tables: Detailed Analysis and Exploitation of CVE-2022-32250", "discussion_count": 5, "resource_count": 7, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023, 2022 ], "items": [ { "item_id": "5f80ef08b44a2fe9", "title": "Conquering a Use-After-Free in nf_tables: Detailed Analysis and Exploitation of CVE-2022-32250", "year": 2023, "authors": [ "Yordan Stoychev" ], "primary_url": "https://anatomic.rip/cve-2022-32250/", "summary_zh": "详细介绍在nf_tables中利用使用后释放漏洞的文章。", "summary_en": "An article detailing the exploitation of a use-after-free vulnerability in nf_tables.", "source_markdown": "[2023: \"Conquering a Use-After-Free in nf_tables: Detailed Analysis and Exploitation of CVE-2022-32250\" by Yordan Stoychev](https://anatomic.rip/cve-2022-32250/) [article] [CVE-2022-32250]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://anatomic.rip/cve-2022-32250/", "raw_path": "/raw/2023-vulnerabilities-lpe-conquering-a-use-after-free-in-nf-tables-detailed-analysis-and-exploitation-of-cve-20.txt" } ] }, { "item_id": "7b5e56c4ac972f1a", "title": "Linux Kernel Exploit (CVE-2022–32250) with mqueue", "year": 2023, "authors": [], "primary_url": "https://blog.theori.io/linux-kernel-exploit-cve-2022-32250-with-mqueue-a8468f32aab5", "summary_zh": "本文探讨了如何利用消息队列中的CVE-2022-32250漏洞进行攻击。", "summary_en": "The article explores the exploitation of CVE-2022-32250 in the Linux kernel using message queues.", "source_markdown": "[2023: \"Linux Kernel Exploit (CVE-2022–32250) with mqueue\"](https://blog.theori.io/linux-kernel-exploit-cve-2022-32250-with-mqueue-a8468f32aab5) [article] [CVE-2022-32250]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.theori.io/linux-kernel-exploit-cve-2022-32250-with-mqueue-a8468f32aab5", "raw_path": "/raw/2023-vulnerabilities-lpe-linux-kernel-exploit-cve-2022-32250-with-mqueue-primary-34bcef8f.txt" } ] }, { "item_id": "9c5620b9dd0cf7b5", "title": "Linux Kernel Exploit (CVE-2022-32250) with mqueue", "year": 2022, "authors": [], "primary_url": "https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/", "summary_zh": "一篇讨论与mqueue相关的Linux内核漏洞的文章。", "summary_en": "An article discussing a Linux kernel exploit related to mqueue.", "source_markdown": "[2022: \"Linux Kernel Exploit (CVE-2022-32250) with mqueue\"](https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/) [article] [CVE-2022-32250]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/", "raw_path": "/raw/2022-vulnerabilities-lpe-linux-kernel-exploit-cve-2022-32250-with-mqueue-primary-fa4b8f4a.txt" } ] }, { "item_id": "07d42fe22fbf064a", "title": "Linux Kernel: Exploiting a Netfilter Use-after-Free in kmalloc-cg", "year": 2022, "authors": [ "Sergi Martinez" ], "primary_url": "https://blog.exodusintel.com/2022/12/19/linux-kernel-exploiting-a-netfilter-use-after-free-in-kmalloc-cg/", "summary_zh": "讨论了Netfilter子系统中的使用后释放漏洞的利用技术。", "summary_en": "Exploitation techniques for a use-after-free vulnerability in the Netfilter subsystem are discussed.", "source_markdown": "[2022: \"Linux Kernel: Exploiting a Netfilter Use-after-Free in kmalloc-cg\" by Sergi Martinez](https://blog.exodusintel.com/2022/12/19/linux-kernel-exploiting-a-netfilter-use-after-free-in-kmalloc-cg/) [article] [CVE-2022-32250]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.exodusintel.com/2022/12/19/linux-kernel-exploiting-a-netfilter-use-after-free-in-kmalloc-cg/", "raw_path": "/raw/2022-vulnerabilities-lpe-linux-kernel-exploiting-a-netfilter-use-after-free-in-kmalloc-cg-primary-5dba05a1.txt" } ] }, { "item_id": "241a455a69aa2f0a", "title": "SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)", "year": 2022, "authors": [], "primary_url": "https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/", "summary_zh": "本文探讨了nf_tables中的有限使用后释放漏洞。", "summary_en": "This article explores a limited use-after-free vulnerability in nf_tables.", "source_markdown": "[2022: \"SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)\"](https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/) [article] [[slides](https://conference.hitb.org/hitbsecconf2022sin/materials/D1T1%20-%20Settlers%20of%20Netlink%20-%20Exploiting%20a%20Limited%20UAF%20on%20Ubuntu%2022.04%20to%20Achieve%20LPE%20-%20Aaron%20Adams.pdf)] [[video](https://www.youtube.com/watch?v=7T_ajYpRWJw)] [CVE-2022-32250]", "affected_area": "nf_tables", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/", "raw_path": "/raw/2022-vulnerabilities-lpe-settlers-of-netlink-exploiting-a-limited-uaf-in-nf-tables-cve-2022-32250-primary-6ea9.txt" }, { "label": "slides", "type": "slides", "url": "https://conference.hitb.org/hitbsecconf2022sin/materials/D1T1%20-%20Settlers%20of%20Netlink%20-%20Exploiting%20a%20Limited%20UAF%20on%20Ubuntu%2022.04%20to%20Achieve%20LPE%20-%20Aaron%20Adams.pdf", "raw_path": "/raw/2022-vulnerabilities-lpe-settlers-of-netlink-exploiting-a-limited-uaf-in-nf-tables-cve-2022-32250-slides-02d8b.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=7T_ajYpRWJw", "raw_path": "/raw/2022-vulnerabilities-lpe-settlers-of-netlink-exploiting-a-limited-uaf-in-nf-tables-cve-2022-32250-video-5a04f3.txt" } ] } ], "rank": 4 }, { "cve": "CVE-2021-26708", "year": 2021, "name": "Exploiting CVE-2021-26708 (Linux kernel) with ssh", "named_from_title": false, "name_source_title": "Exploiting CVE-2021-26708 (Linux kernel) with ssh", "discussion_count": 4, "resource_count": 8, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "virtual socket transport", "kernel_location": "net/", "component_confidence": "high", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022, 2021 ], "items": [ { "item_id": "3a681aa677ca7965", "title": "Exploiting CVE-2021-26708 (Linux kernel) with ssh", "year": 2022, "authors": [], "primary_url": "https://hardenedvault.net/2022/03/01/poc-cve-2021-26708.html", "summary_zh": "CVE-2021-26708是Linux内核中的本地权限提升漏洞。", "summary_en": "CVE-2021-26708 is a local privilege escalation vulnerability in the Linux kernel.", "source_markdown": "[2022: \"Exploiting CVE-2021-26708 (Linux kernel) with ssh\"](https://hardenedvault.net/2022/03/01/poc-cve-2021-26708.html) [article] [CVE-2021-26708]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://hardenedvault.net/2022/03/01/poc-cve-2021-26708.html", "raw_path": "/raw/2022-vulnerabilities-lpe-exploiting-cve-2021-26708-linux-kernel-with-ssh-primary-abc947f2.txt" } ] }, { "item_id": "8d362be7cca544de", "title": "Four Bytes of Power: exploiting CVE-2021-26708 in the Linux kernel", "year": 2021, "authors": [], "primary_url": "https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html", "summary_zh": "CVE-2021-26708是Linux内核中的一个漏洞，可被利用进行本地权限提升。", "summary_en": "CVE-2021-26708 is a vulnerability in the Linux kernel that can be exploited for local privilege escalation.", "source_markdown": "[2021: \"Four Bytes of Power: exploiting CVE-2021-26708 in the Linux kernel\"](https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html) [article] [[slides](https://a13xp0p0v.github.io/img/CVE-2021-26708.pdf)] [[video](https://www.youtube.com/watch?v=EMcjHfceX44)] [CVE-2021-26708]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html", "raw_path": "/raw/2021-vulnerabilities-lpe-four-bytes-of-power-exploiting-cve-2021-26708-in-the-linux-kernel-primary-b1fa79c5.txt" }, { "label": "slides", "type": "slides", "url": "https://a13xp0p0v.github.io/img/CVE-2021-26708.pdf", "raw_path": "/raw/2021-vulnerabilities-lpe-four-bytes-of-power-exploiting-cve-2021-26708-in-the-linux-kernel-slides-52877104.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=EMcjHfceX44", "raw_path": "/raw/2021-vulnerabilities-lpe-four-bytes-of-power-exploiting-cve-2021-26708-in-the-linux-kernel-video-3189870a.txt" } ] }, { "item_id": "c46d7d68b85380a1", "title": "Gaining root access in Linux using the CVE-2021-26708 vulnerability", "year": 2021, "authors": [ "Markel Azpeitia Loiti" ], "primary_url": "https://addi.ehu.es/bitstream/handle/10810/53355/GrAL_MAzpeitia.pdf", "summary_zh": "2021 年 Linux 内核LPE资料：「Gaining root access in Linux using the CVE-2021-26708 vulnerability」（CVE-2021-26708）；URL 类型：paper。", "summary_en": "2021 Linux kernel LPE resource \"Gaining root access in Linux using the CVE-2021-26708 vulnerability\" (CVE-2021-26708); URL type: paper.", "source_markdown": "[2021: \"Gaining root access in Linux using the CVE-2021-26708 vulnerability\" by Markel Azpeitia Loiti](https://addi.ehu.es/bitstream/handle/10810/53355/GrAL_MAzpeitia.pdf) [paper]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "paper", "url": "https://addi.ehu.es/bitstream/handle/10810/53355/GrAL_MAzpeitia.pdf", "raw_path": "/raw/2021-vulnerabilities-lpe-gaining-root-access-in-linux-using-the-cve-2021-26708-vulnerability-primary-23a382c0.txt" } ] }, { "item_id": "ce2ef50333b2718a", "title": "Improving the exploit for CVE-2021-26708 in the Linux kernel to bypass LKRG", "year": 2021, "authors": [ "Alexander Popov" ], "primary_url": "https://a13xp0p0v.github.io/2021/08/25/lkrg-bypass.html", "summary_zh": "2021 年 Linux 内核LPE资料：「Improving the exploit for CVE-2021-26708 in the Linux kernel to bypass LKRG」（CVE-2021-26708）；URL 类型：article。", "summary_en": "2021 Linux kernel LPE resource \"Improving the exploit for CVE-2021-26708 in the Linux kernel to bypass LKRG\" (CVE-2021-26708); URL type: article.", "source_markdown": "[2021: \"Improving the exploit for CVE-2021-26708 in the Linux kernel to bypass LKRG\" by Alexander Popov](https://a13xp0p0v.github.io/2021/08/25/lkrg-bypass.html) [article] [[slides](https://a13xp0p0v.github.io/img/CVE-2021-26708_LKRG_bypass.pdf)] [[video](https://www.youtube.com/watch?v=n6YLiYiCIMA)]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://a13xp0p0v.github.io/2021/08/25/lkrg-bypass.html", "raw_path": "/raw/2021-vulnerabilities-lpe-improving-the-exploit-for-cve-2021-26708-in-the-linux-kernel-to-bypass-lkrg-primary-2.txt" }, { "label": "slides", "type": "slides", "url": "https://a13xp0p0v.github.io/img/CVE-2021-26708_LKRG_bypass.pdf", "raw_path": "/raw/2021-vulnerabilities-lpe-improving-the-exploit-for-cve-2021-26708-in-the-linux-kernel-to-bypass-lkrg-slides-58.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=n6YLiYiCIMA", "raw_path": "/raw/2021-vulnerabilities-lpe-improving-the-exploit-for-cve-2021-26708-in-the-linux-kernel-to-bypass-lkrg-video-94e.txt" } ] } ], "rank": 5 }, { "cve": "CVE-2025-21479", "year": 2025, "name": "A Walk Through Android Physical Memory: CVE-2025-21479 Privilege Escalation", "named_from_title": false, "name_source_title": "A Walk Through Android Physical Memory: CVE-2025-21479 Privilege Escalation", "discussion_count": 4, "resource_count": 5, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Qualcomm Adreno GPU", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2026, "article_years": [ 2026, 2025 ], "items": [ { "item_id": "b50a6bfa4618d701", "title": "Exploring Android ROOT via CVE-2025-21479", "year": 2026, "authors": [], "primary_url": "https://medium.com/@numencyberlabs/exploring-android-root-via-cve-2025-21479-eca9fb7ca6e9", "summary_zh": "一篇文章探讨了被识别为CVE-2025-21479的Android权限提升漏洞。", "summary_en": "An article exploring a privilege escalation vulnerability in Android identified as CVE-2025-21479.", "source_markdown": "[2026: \"Exploring Android ROOT via CVE-2025-21479\"](https://medium.com/@numencyberlabs/exploring-android-root-via-cve-2025-21479-eca9fb7ca6e9) [article] [CVE-2025-21479]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://medium.com/@numencyberlabs/exploring-android-root-via-cve-2025-21479-eca9fb7ca6e9", "raw_path": "/raw/2026-vulnerabilities-lpe-exploring-android-root-via-cve-2025-21479-primary-b9b57b89.txt" } ] }, { "item_id": "ef40a628763837a7", "title": "A Walk Through Android Physical Memory: CVE-2025-21479 Privilege Escalation", "year": 2025, "authors": [], "primary_url": "https://dawnslab.jd.com/android_gpu_attack_cve_2025_21479/", "summary_zh": "2025 年 Linux 内核LPE资料：「A Walk Through Android Physical Memory: CVE-2025-21479 Privilege Escalation」（CVE-2025-21479）；URL 类型：article。 Android 影响：yes。", "summary_en": "2025 Linux kernel LPE resource \"A Walk Through Android Physical Memory: CVE-2025-21479 Privilege Escalation\" (CVE-2025-21479); URL type: article. Android impact: yes.", "source_markdown": "[2025: \"A Walk Through Android Physical Memory: CVE-2025-21479 Privilege Escalation\"](https://dawnslab.jd.com/android_gpu_attack_cve_2025_21479/) [article] [[comment](https://notnow.dev/notice/AxeTvYDZPDEvRjmLpY)] [CVE-2025-21479]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://dawnslab.jd.com/android_gpu_attack_cve_2025_21479/", "raw_path": "/raw/2025-vulnerabilities-lpe-a-walk-through-android-physical-memory-cve-2025-21479-privilege-escalation-primary-91.txt" }, { "label": "comment", "type": "discussion", "url": "https://notnow.dev/notice/AxeTvYDZPDEvRjmLpY", "raw_path": "/raw/2025-vulnerabilities-lpe-a-walk-through-android-physical-memory-cve-2025-21479-privilege-escalation-comment-90.txt" } ] }, { "item_id": "ef24547c37378b48", "title": "Exploiting CVE-2025-21479 on a Samsung S23", "year": 2025, "authors": [ "XploitBengineer" ], "primary_url": "https://xploitbengineer.github.io/CVE-2025-21479", "summary_zh": "一篇详细介绍在Samsung S23中利用本地特权升级漏洞的文章。", "summary_en": "An article detailing the exploitation of a local privilege escalation vulnerability in the Samsung S23.", "source_markdown": "[2025: \"Exploiting CVE-2025-21479 on a Samsung S23\" by XploitBengineer](https://xploitbengineer.github.io/CVE-2025-21479) [article] [CVE-2025-21479]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions an Android OEM/device family", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://xploitbengineer.github.io/CVE-2025-21479", "raw_path": "/raw/2025-vulnerabilities-lpe-exploiting-cve-2025-21479-on-a-samsung-s23-primary-88c8fb34.txt" } ] }, { "item_id": "d8eedb93fd726bf5", "title": "FreeXR/eureka_panther-adreno-gpu-exploit-1", "year": 2025, "authors": [], "primary_url": "https://github.com/FreeXR/eureka_panther-adreno-gpu-exploit-1", "summary_zh": "针对与Adreno GPU相关的CVE-2025-21479的漏洞利用。", "summary_en": "An exploit targeting CVE-2025-21479 related to the Adreno GPU.", "source_markdown": "https://github.com/FreeXR/eureka_panther-adreno-gpu-exploit-1 [CVE-2025-21479]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "exploit", "url": "https://github.com/FreeXR/eureka_panther-adreno-gpu-exploit-1", "raw_path": "/raw/2025-exploits-freexr-eureka-panther-adreno-gpu-exploit-1-primary-60b387b5.txt" } ] } ], "rank": 6 }, { "cve": "CVE-2025-38352", "year": 2025, "name": "Chronomaly", "named_from_title": true, "name_source_title": "CVE-2025-38352 (Part 3) - Uncovering Chronomaly", "discussion_count": 4, "resource_count": 5, "component_id": "core-kernel", "component_label": "Core kernel / task lifetime", "component_detail": "kernel timer/clock lifetime", "kernel_location": "kernel/ + fs/exec.c", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "93890b5e2f580f59", "title": "CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC", "year": 2025, "authors": [ "Faith" ], "primary_url": "https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/", "summary_zh": "CVE-2025-38352分析揭示了Android内核中的实际漏洞，导致本地特权提升。", "summary_en": "CVE-2025-38352 analysis reveals in-the-wild vulnerabilities in the Android kernel leading to local privilege escalation.", "source_markdown": "[2025: \"CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC\" by Faith](https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/) [article] [CVE-2025-38352]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-38352-part-1-in-the-wild-android-kernel-vulnerability-analysis-poc-primary-3.txt" } ] }, { "item_id": "c35f9da7c990ed8c", "title": "CVE-2025-38352 (Part 2) - Extending The Race Window Without a Kernel Patch", "year": 2025, "authors": [ "Faith" ], "primary_url": "https://faith2dxy.xyz/2025-12-24/cve_2025_38352_analysis_part_2/", "summary_zh": "CVE-2025-38352的第2部分在没有内核补丁的情况下扩展了本地特权提升的竞争窗口。", "summary_en": "Part 2 of CVE-2025-38352 extends the race window for local privilege escalation without kernel patches.", "source_markdown": "[2025: \"CVE-2025-38352 (Part 2) - Extending The Race Window Without a Kernel Patch\" by Faith](https://faith2dxy.xyz/2025-12-24/cve_2025_38352_analysis_part_2/) [article] [CVE-2025-38352]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://faith2dxy.xyz/2025-12-24/cve_2025_38352_analysis_part_2/", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-38352-part-2-extending-the-race-window-without-a-kernel-patch-primary-3bed9c.txt" } ] }, { "item_id": "2e3b7849bf47c927", "title": "CVE-2025-38352 (Part 3) - Uncovering Chronomaly", "year": 2025, "authors": [ "Faith" ], "primary_url": "https://faith2dxy.xyz/2026-01-03/cve_2025_38352_analysis_part_3/", "summary_zh": "CVE-2025-38352的第3部分揭示了在Android内核中利用该漏洞的额外技术。", "summary_en": "Part 3 of CVE-2025-38352 uncovers additional techniques for exploiting the vulnerability in the Android kernel.", "source_markdown": "[2025: \"CVE-2025-38352 (Part 3) - Uncovering Chronomaly\" by Faith](https://faith2dxy.xyz/2026-01-03/cve_2025_38352_analysis_part_3/) [article] [exploit](https://github.com/farazsth98/chronomaly) [CVE-2025-38352]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://faith2dxy.xyz/2026-01-03/cve_2025_38352_analysis_part_3/", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-38352-part-3-uncovering-chronomaly-primary-56930ee8.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/farazsth98/chronomaly", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-38352-part-3-uncovering-chronomaly-exploit-e83d12db.txt" } ] }, { "item_id": "e75749cddfa3bdb2", "title": "Race Against Time in the Kernel’s Clockwork", "year": 2025, "authors": [ "Shreyas Penkar" ], "primary_url": "https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/", "summary_zh": "本文讨论了Linux内核时钟子系统中的竞争条件漏洞。", "summary_en": "This article discusses a race condition vulnerability in the Linux kernel's clock subsystem.", "source_markdown": "[2025: \"Race Against Time in the Kernel’s Clockwork\" by Shreyas Penkar](https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/) [article] [CVE-2025-38352]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/", "raw_path": "/raw/2025-vulnerabilities-other-race-against-time-in-the-kernel-s-clockwork-primary-1eb1b064.txt" } ] } ], "rank": 7 }, { "cve": "CVE-2020-28343", "year": 2020, "name": "Galaxy's Meltdown", "named_from_title": true, "name_source_title": "Galaxy's Meltdown - Exploiting SVE-2020-18610", "discussion_count": 4, "resource_count": 4, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Samsung NPU driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023, 2021, 2020 ], "items": [ { "item_id": "b1cafe59e420c497", "title": "Attacking NPUs of Multiple Platforms", "year": 2023, "authors": [], "primary_url": "https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf", "summary_zh": "这些幻灯片涵盖了多个平台上与NPU相关的漏洞。", "summary_en": "The slides cover vulnerabilities related to NPUs across multiple platforms.", "source_markdown": "[2023: \"Attacking NPUs of Multiple Platforms\"](https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf) [slides] [CVE-2022-22265] [CVE-2020-28343] [SVE-2021-20204] [CVE-2023-42483] [CVE-2023-45864]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf", "raw_path": "/raw/2023-vulnerabilities-other-attacking-npus-of-multiple-platforms-primary-e362137b.txt" } ] }, { "item_id": "63ee9962aeea933a", "title": "[BugTales] A Nerve-Racking Bug Collision in Samsung's NPU Driver", "year": 2021, "authors": [ "Gyorgy Miru" ], "primary_url": "https://labs.taszk.io/articles/post/bug_collision_in_samsungs_npu_driver/", "summary_zh": "CVE-2020-28343是三星NPU驱动程序中的本地权限提升漏洞。", "summary_en": "CVE-2020-28343 is a local privilege escalation vulnerability in Samsung's NPU driver.", "source_markdown": "[2021: \"[BugTales] A Nerve-Racking Bug Collision in Samsung's NPU Driver\" by Gyorgy Miru](https://labs.taszk.io/articles/post/bug_collision_in_samsungs_npu_driver/) [article] [CVE-2020-28343, SVE-2020-18610]", "affected_area": "NPU driver", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions an Android OEM/device family", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://labs.taszk.io/articles/post/bug_collision_in_samsungs_npu_driver/", "raw_path": "/raw/2021-vulnerabilities-lpe-bugtales-a-nerve-racking-bug-collision-in-samsung-s-npu-driver-primary-f1feefe6.txt" } ] }, { "item_id": "812dada3f180b882", "title": "Galaxy's Meltdown - Exploiting SVE-2020-18610", "year": 2021, "authors": [], "primary_url": "https://github.com/vngkv123/articles/blob/main/Galaxy's%20Meltdown%20-%20Exploiting%20SVE-2020-18610.md", "summary_zh": "该文章讨论了利用CVE-2020-28343，这是三星NPU驱动程序中的一个本地权限提升漏洞。", "summary_en": "The article discusses exploiting CVE-2020-28343, a local privilege escalation vulnerability in Samsung's NPU driver.", "source_markdown": "[2021: \"Galaxy's Meltdown - Exploiting SVE-2020-18610\"](https://github.com/vngkv123/articles/blob/main/Galaxy's%20Meltdown%20-%20Exploiting%20SVE-2020-18610.md) [article] [CVE-2020-28343, SVE-2020-18610]", "affected_area": "NPU driver", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions an Android OEM/device family", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/vngkv123/articles/blob/main/Galaxy's%20Meltdown%20-%20Exploiting%20SVE-2020-18610.md", "raw_path": "/raw/2021-vulnerabilities-lpe-galaxy-s-meltdown-exploiting-sve-2020-18610-primary-4ea5f2bb.txt" } ] }, { "item_id": "4303675a708e0344", "title": "An iOS hacker tries Android", "year": 2020, "authors": [ "Brandon Azad" ], "primary_url": "https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html", "summary_zh": "2020 年 Linux 内核LPE资料：「An iOS hacker tries Android」（CVE-2020-28343）；URL 类型：article。 Android 影响：yes。", "summary_en": "2020 Linux kernel LPE resource \"An iOS hacker tries Android\" (CVE-2020-28343); URL type: article. Android impact: yes.", "source_markdown": "[2020: \"An iOS hacker tries Android\" by Brandon Azad](https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html) [article] [CVE-2020-28343, SVE-2020-18610]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html", "raw_path": "/raw/2020-vulnerabilities-lpe-an-ios-hacker-tries-android-primary-105c16cc.txt" } ] } ], "rank": 8 }, { "cve": "CVE-2020-0041", "year": 2020, "name": "Binder - Analysis and exploitation of CVE-2020-0041", "named_from_title": false, "name_source_title": "Binder - Analysis and exploitation of CVE-2020-0041", "discussion_count": 4, "resource_count": 4, "component_id": "android-ipc", "component_label": "Android IPC / Binder", "component_detail": "Binder IPC", "kernel_location": "drivers/android/", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2020, "article_years": [ 2020 ], "items": [ { "item_id": "916c9edc360d3314", "title": "Binder - Analysis and exploitation of CVE-2020-0041", "year": 2020, "authors": [ "Jean-Baptiste Cayrou" ], "primary_url": "https://www.synacktiv.com/posts/exploit/binder-analysis-and-exploitation-of-cve-2020-0041.html", "summary_zh": "2020 年 Linux 内核LPE资料：「Binder - Analysis and exploitation of CVE-2020-0041」（CVE-2020-0041）；URL 类型：article。 Android 影响：possible。", "summary_en": "2020 Linux kernel LPE resource \"Binder - Analysis and exploitation of CVE-2020-0041\" (CVE-2020-0041); URL type: article. Android impact: possible.", "source_markdown": "[2020: \"Binder - Analysis and exploitation of CVE-2020-0041\" by Jean-Baptiste Cayrou](https://www.synacktiv.com/posts/exploit/binder-analysis-and-exploitation-of-cve-2020-0041.html) [article] [CVE-2020-0041]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Binder, a core Android IPC driver", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.synacktiv.com/posts/exploit/binder-analysis-and-exploitation-of-cve-2020-0041.html", "raw_path": "/raw/2020-vulnerabilities-lpe-binder-analysis-and-exploitation-of-cve-2020-0041-primary-0ee8e5af.txt" } ] }, { "item_id": "ee91f4975a8fc252", "title": "Binder IPC and its vulnerabilities", "year": 2020, "authors": [ "Jean-Baptiste Cayrou at THCON" ], "primary_url": "https://www.synacktiv.com/ressources/thcon2020_binder.pdf", "summary_zh": "2020 年 Linux 内核LPE资料：「Binder IPC and its vulnerabilities」（CVE-2019-2215、CVE-2019-2025、CVE-2019-2181、CVE-2019-2214、CVE-2020-0041）；URL 类型：slides。 Android 影响：possible。", "summary_en": "2020 Linux kernel LPE resource \"Binder IPC and its vulnerabilities\" (CVE-2019-2215, CVE-2019-2025, CVE-2019-2181, CVE-2019-2214, CVE-2020-0041); URL type: slides. Android impact: possible.", "source_markdown": "[2020: \"Binder IPC and its vulnerabilities\" by Jean-Baptiste Cayrou at THCON](https://www.synacktiv.com/ressources/thcon2020_binder.pdf) [slides] [CVE-2019-2215, CVE-2019-2025, CVE-2019-2181, CVE-2019-2214, CVE-2020-0041]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Binder, a core Android IPC driver", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://www.synacktiv.com/ressources/thcon2020_binder.pdf", "raw_path": "/raw/2020-vulnerabilities-lpe-binder-ipc-and-its-vulnerabilities-primary-bcf82314.txt" } ] }, { "item_id": "3b33b1938f9a79f9", "title": "bluefrostsecurity/CVE-2020-0041", "year": 2020, "authors": [], "primary_url": "https://github.com/bluefrostsecurity/CVE-2020-0041/", "summary_zh": "CVE-2020-0041漏洞的利用代码。", "summary_en": "Exploit code for CVE-2020-0041 vulnerability.", "source_markdown": "https://github.com/bluefrostsecurity/CVE-2020-0041/", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/bluefrostsecurity/CVE-2020-0041/", "raw_path": "/raw/2020-exploits-bluefrostsecurity-cve-2020-0041-primary-fc97baaf.txt" } ] }, { "item_id": "7c50b641b9228dc8", "title": "Exploiting CVE-2020-0041 - Part 2: Escalating to root", "year": 2020, "authors": [ "Eloi Sanfelix", "Jordan Gruskovnjak" ], "primary_url": "https://labs.bluefrostsecurity.de/blog/2020/04/08/cve-2020-0041-part-2-escalating-to-root/", "summary_zh": "2020 年 Linux 内核LPE资料：「Exploiting CVE-2020-0041 - Part 2: Escalating to root」（CVE-2020-0041）；URL 类型：article。", "summary_en": "2020 Linux kernel LPE resource \"Exploiting CVE-2020-0041 - Part 2: Escalating to root\" (CVE-2020-0041); URL type: article.", "source_markdown": "[2020: \"Exploiting CVE-2020-0041 - Part 2: Escalating to root\" by Eloi Sanfelix and Jordan Gruskovnjak](https://labs.bluefrostsecurity.de/blog/2020/04/08/cve-2020-0041-part-2-escalating-to-root/) [article] [CVE-2020-0041]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://labs.bluefrostsecurity.de/blog/2020/04/08/cve-2020-0041-part-2-escalating-to-root/", "raw_path": "/raw/2020-vulnerabilities-lpe-exploiting-cve-2020-0041-part-2-escalating-to-root-primary-4f0e32d1.txt" } ] } ], "rank": 9 }, { "cve": "CVE-2020-27786", "year": 2020, "name": "Race Condition + Use-After-Free", "named_from_title": false, "name_source_title": "CVE-2020-27786 (Race Condition + Use-After-Free)", "discussion_count": 4, "resource_count": 4, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "memory management or page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024, 2023, 2022 ], "items": [ { "item_id": "76ea0d38eed3f130", "title": "CVE-2020-27786 (Race Condition + Use-After-Free)", "year": 2024, "authors": [ "ii4gsp" ], "primary_url": "https://ii4gsp.github.io/cve-2020-27786/", "summary_zh": "一篇详细介绍CVE-2020-27786的文章，涉及竞争条件和使用后释放漏洞。", "summary_en": "An article detailing CVE-2020-27786, which involves a race condition and use-after-free vulnerability.", "source_markdown": "[2024: \"CVE-2020-27786 (Race Condition + Use-After-Free)\" by ii4gsp](https://ii4gsp.github.io/cve-2020-27786/) [article] [CVE-2020-27786]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://ii4gsp.github.io/cve-2020-27786/", "raw_path": "/raw/2024-vulnerabilities-lpe-cve-2020-27786-race-condition-use-after-free-primary-ec837278.txt" } ] }, { "item_id": "3deeb073f5813c7e", "title": "CVE-2020-27786 exploitation userfaultfd + patching file struct etc passwd", "year": 2023, "authors": [], "primary_url": "https://soez.github.io/posts/CVE-2020-27786-exploitation-userfaultfd-+-patching-file-struct-etc-passwd/", "summary_zh": "本文探讨了如何利用userfaultfd进行CVE-2020-27786的攻击。", "summary_en": "The article explores the exploitation of CVE-2020-27786 using userfaultfd.", "source_markdown": "[2023: \"CVE-2020-27786 exploitation userfaultfd + patching file struct etc passwd\"](https://soez.github.io/posts/CVE-2020-27786-exploitation-userfaultfd-+-patching-file-struct-etc-passwd/) [article] [CVE-2020-27786]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://soez.github.io/posts/CVE-2020-27786-exploitation-userfaultfd-+-patching-file-struct-etc-passwd/", "raw_path": "/raw/2023-vulnerabilities-lpe-cve-2020-27786-exploitation-userfaultfd-patching-file-struct-etc-passwd-primary-6769e.txt" } ] }, { "item_id": "14c88bbd15ccb26b", "title": "Linux Kernel Exploit Development: 1day case study", "year": 2022, "authors": [ "Alessandro Groppo" ], "primary_url": "https://blog.hacktivesecurity.com/index.php/2022/06/13/linux-kernel-exploit-development-1day-case-study/", "summary_zh": "介绍了针对Linux内核漏洞的利用开发的案例研究。", "summary_en": "A case study on the development of exploits for a Linux kernel vulnerability is presented.", "source_markdown": "[2022: \"Linux Kernel Exploit Development: 1day case study\" by Alessandro Groppo](https://blog.hacktivesecurity.com/index.php/2022/06/13/linux-kernel-exploit-development-1day-case-study/) [article] [CVE-2020-27786]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.hacktivesecurity.com/index.php/2022/06/13/linux-kernel-exploit-development-1day-case-study/", "raw_path": "/raw/2022-vulnerabilities-lpe-linux-kernel-exploit-development-1day-case-study-primary-dd90d362.txt" } ] }, { "item_id": "ab19846f06bdcd22", "title": "Linux Kernel n-day exploit development", "year": 2022, "authors": [], "primary_url": "https://1day.dev/notes/Linux-Kernel-n-day-exploit-development/", "summary_zh": "本文介绍了针对已知Linux内核漏洞的利用开发。", "summary_en": "This article covers the development of exploits for a known Linux kernel vulnerability.", "source_markdown": "[2022: \"Linux Kernel n-day exploit development\"](https://1day.dev/notes/Linux-Kernel-n-day-exploit-development/) [article] [CVE-2020-27786]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://1day.dev/notes/Linux-Kernel-n-day-exploit-development/", "raw_path": "/raw/2022-vulnerabilities-lpe-linux-kernel-n-day-exploit-development-primary-327529a4.txt" } ] } ], "rank": 10 }, { "cve": "CVE-2022-0185", "year": 2022, "name": "Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers", "named_from_title": false, "name_source_title": "CVE-2022-0185 - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers", "discussion_count": 4, "resource_count": 4, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem context handling", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "high", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "9f42a6d910b68c73", "title": "CVE-2022-0185 - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers", "year": 2022, "authors": [], "primary_url": "https://www.willsroot.io/2022/01/cve-2022-0185.html", "summary_zh": "CVE-2022-0185展示了影响Ubuntu的本地权限提升漏洞。", "summary_en": "CVE-2022-0185 demonstrates a local privilege escalation vulnerability affecting Ubuntu.", "source_markdown": "[2022: \"CVE-2022-0185 - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers\"](https://www.willsroot.io/2022/01/cve-2022-0185.html) [article] [CVE-2022-0185]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.willsroot.io/2022/01/cve-2022-0185.html", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-0185-winning-a-31337-bounty-after-pwning-ubuntu-and-escaping-google-s-kctf-c.txt" } ] }, { "item_id": "21b1c7874139bd2d", "title": "CVE-2022-0185: A Case Study", "year": 2022, "authors": [], "primary_url": "https://www.hackthebox.com/blog/CVE-2022-0185:_A_case_study", "summary_zh": "CVE-2022-0185被分析为本地权限提升的案例研究。", "summary_en": "CVE-2022-0185 is analyzed as a case study for local privilege escalation.", "source_markdown": "[2022: \"CVE-2022-0185: A Case Study\"](https://www.hackthebox.com/blog/CVE-2022-0185:_A_case_study) [article] [CVE-2022-0185]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.hackthebox.com/blog/CVE-2022-0185:_A_case_study", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-0185-a-case-study-primary-dda875ac.txt" } ] }, { "item_id": "08d3742ddc771c18", "title": "CVE-2022-0185: Analysis and utilization and thinking and practice of new primitives for pipe", "year": 2022, "authors": [], "primary_url": "https://veritas501.github.io/2022_03_16-CVE_2022_0185%E5%88%86%E6%9E%90%E5%8F%8A%E5%88%A9%E7%94%A8%E4%B8%8Epipe%E6%96%B0%E5%8E%9F%E8%AF%AD%E6%80%9D%E8%80%83%E4%B8%8E%E5%AE%9E%E8%B7%B5/#%E7%9C%9F%E2%80%A2%E6%AD%A3%E6%96%87-%E6%96%B0%E5%9E%8B%E5%88%A9%E7%94%A8%E5%8E%9F%E8%AF%AD-pipe", "summary_zh": "CVE-2022-0185探索了Linux内核中管道利用的新原语。", "summary_en": "CVE-2022-0185 explores new primitives for pipe exploitation in the Linux kernel.", "source_markdown": "[2022: \"CVE-2022-0185: Analysis and utilization and thinking and practice of new primitives for pipe\"](https://veritas501.github.io/2022_03_16-CVE_2022_0185%E5%88%86%E6%9E%90%E5%8F%8A%E5%88%A9%E7%94%A8%E4%B8%8Epipe%E6%96%B0%E5%8E%9F%E8%AF%AD%E6%80%9D%E8%80%83%E4%B8%8E%E5%AE%9E%E8%B7%B5/#%E7%9C%9F%E2%80%A2%E6%AD%A3%E6%96%87-%E6%96%B0%E5%9E%8B%E5%88%A9%E7%94%A8%E5%8E%9F%E8%AF%AD-pipe) [article] [CVE-2022-0185]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://veritas501.github.io/2022_03_16-CVE_2022_0185%E5%88%86%E6%9E%90%E5%8F%8A%E5%88%A9%E7%94%A8%E4%B8%8Epipe%E6%96%B0%E5%8E%9F%E8%AF%AD%E6%80%9D%E8%80%83%E4%B8%8E%E5%AE%9E%E8%B7%B5/#%E7%9C%9F%E2%80%A2%E6%AD%A3%E6%96%87-%E6%96%B0%E5%9E%8B%E5%88%A9%E7%94%A8%E5%8E%9F%E8%AF%AD-pipe", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-0185-analysis-and-utilization-and-thinking-and-practice-of-new-primitives-fo.txt" } ] }, { "item_id": "b96ccc0860b4b448", "title": "CVE-2022-0185: Linux kernel slab out-of-bounds write: exploit and writeup", "year": 2022, "authors": [ "Alejandro Guerrero" ], "primary_url": "https://www.openwall.com/lists/oss-security/2022/01/25/14", "summary_zh": "CVE-2022-0185涉及Linux内核中的slab越界写漏洞。", "summary_en": "CVE-2022-0185 involves a slab out-of-bounds write vulnerability in the Linux kernel.", "source_markdown": "[2022: \"CVE-2022-0185: Linux kernel slab out-of-bounds write: exploit and writeup\" by Alejandro Guerrero](https://www.openwall.com/lists/oss-security/2022/01/25/14) [article] [CVE-2022-0185]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.openwall.com/lists/oss-security/2022/01/25/14", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-0185-linux-kernel-slab-out-of-bounds-write-exploit-and-writeup-primary-8f741.txt" } ] } ], "rank": 11 }, { "cve": "CVE-2024-53104", "year": 2024, "name": "A Quick Note on CVE-2024-53104", "named_from_title": false, "name_source_title": "A Quick Note on CVE-2024-53104", "discussion_count": 3, "resource_count": 10, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "USB Video Class driver", "kernel_location": "drivers/", "component_confidence": "high", "android_priority": "high", "android_reason": "与 Cellebrite 手机利用链材料关联，且定位到 USB Video Class 驱动，优先核对 Android 设备版本。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "087b9d68904a941d", "title": "A Quick Note on CVE-2024-53104", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/03/23/a-quick-note-on-CVE-2024-53104.html", "summary_zh": "本文简要介绍了CVE-2024-53104。", "summary_en": "A quick note on CVE-2024-53104 is presented in this article.", "source_markdown": "[2025: \"A Quick Note on CVE-2024-53104\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/03/23/a-quick-note-on-CVE-2024-53104.html) [article] [CVE-2024-53104]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/03/23/a-quick-note-on-CVE-2024-53104.html", "raw_path": "/raw/2025-vulnerabilities-other-a-quick-note-on-cve-2024-53104-primary-1a53c468.txt" } ] }, { "item_id": "bc2c679ba638896b", "title": "Cellebrite zero-day exploit used to target phone of Serbian student activist", "year": 2025, "authors": [], "primary_url": "https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/", "summary_zh": "本文讨论了针对塞尔维亚学生活动家手机的零日漏洞利用。", "summary_en": "This article discusses a zero-day exploit targeting a Serbian student activist's phone.", "source_markdown": "[2025: \"Cellebrite zero-day exploit used to target phone of Serbian student activist\"](https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/) [article] [CVE-2024-53104] [CVE-2024-53197] [CVE-2024-50302] [[note 1](https://infosec.exchange/@zhuowei@notnow.dev/114130367739741197)] [[note 2](https://infosec.exchange/@zhuowei@notnow.dev/114323100736073083)] [[note 3](https://infosec.exchange/@zhuowei@notnow.dev/114329166341368428)] [[note 4](https://infosec.exchange/@zhuowei@notnow.dev/114405047904139584)] [[note 5](https://infosec.exchange/@zhuowei@notnow.dev/114453583508015434)] [[note 6](https://infosec.exchange/@zhuowei@notnow.dev/114531934296778222)] [[note 7](https://infosec.exchange/@twiddles/114343055353217091)]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-primar.txt" }, { "label": "note 1", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114130367739741197", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-1.txt" }, { "label": "note 2", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114323100736073083", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-2.txt" }, { "label": "note 3", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114329166341368428", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-3.txt" }, { "label": "note 4", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114405047904139584", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-4.txt" }, { "label": "note 5", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114453583508015434", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-5.txt" }, { "label": "note 6", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114531934296778222", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-6.txt" }, { "label": "note 7", "type": "article", "url": "https://infosec.exchange/@twiddles/114343055353217091", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-7.txt" } ] }, { "item_id": "f3913470a2be3cdf", "title": "External fuzzing of Linux kernel USB drivers with syzkaller", "year": 2025, "authors": [ "Andrey Konovalov" ], "primary_url": "https://docs.google.com/presentation/d/1ba7Au3Gt6dEQAsfZmjUdzjVWHKxE_EdaJGU9WOSF-Ts/edit?usp=sharing", "summary_zh": "这些幻灯片展示了使用syzkaller对Linux内核USB驱动程序进行外部模糊测试的结果。", "summary_en": "These slides present findings on external fuzzing of Linux kernel USB drivers using syzkaller.", "source_markdown": "[2025: \"External fuzzing of Linux kernel USB drivers with syzkaller\" by Andrey Konovalov](https://docs.google.com/presentation/d/1ba7Au3Gt6dEQAsfZmjUdzjVWHKxE_EdaJGU9WOSF-Ts/edit?usp=sharing) [slides] [CVE-2024-53104]", "affected_area": "USB", "android_status": "no", "android_confirmed": false, "android_reason": "Not enough evidence that this resource maps to released Android devices.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://docs.google.com/presentation/d/1ba7Au3Gt6dEQAsfZmjUdzjVWHKxE_EdaJGU9WOSF-Ts/edit?usp=sharing", "raw_path": "/raw/2025-finding-bugs-external-fuzzing-of-linux-kernel-usb-drivers-with-syzkaller-primary-8495ebad.txt" } ] } ], "rank": 12 }, { "cve": "CVE-2023-20938", "year": 2023, "name": "Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938", "named_from_title": false, "name_source_title": "Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938", "discussion_count": 3, "resource_count": 8, "component_id": "android-ipc", "component_label": "Android IPC / Binder", "component_detail": "Binder IPC", "kernel_location": "drivers/android/", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "6652bc32fe01330e", "title": "Android Binder Attack Matrix", "year": 2024, "authors": [ "Utkarsh" ], "primary_url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-introduction-450d31d1d951", "summary_zh": "一篇介绍Android Binder攻击矩阵及其漏洞的文章。", "summary_en": "An article introducing the Android Binder Attack Matrix and its vulnerabilities.", "source_markdown": "[2024: \"Android Binder Attack Matrix\" by Utkarsh](https://utkarshcodes.medium.com/android-binder-attack-matrix-introduction-450d31d1d951) [article]\n[[part 2](https://utkarshcodes.medium.com/android-binder-attack-matrix-cve-2023-20938-cve-2023-21255-uaf-details-article-1-4cc2eb3919f9)]\n[[part 3](https://utkarshcodes.medium.com/android-binder-attack-matrix-exploitation-of-cve-2023-20938-article-2-6215160e3373)]\n[[part 4](https://utkarshcodes.medium.com/android-binder-attack-matrix-fuzzing-binder-with-linux-kernel-library-lkl-article-3-62e931161eb5)]\n[[part 5](https://utkarshcodes.medium.com/android-binder-attack-matrix-results-conclusion-d7143057408f)]", "affected_area": "Binder", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-introduction-450d31d1d951", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-primary-c55362d7.txt" }, { "label": "part 2", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-cve-2023-20938-cve-2023-21255-uaf-details-article-1-4cc2eb3919f9", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-part-2-ba997b47.txt" }, { "label": "part 3", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-exploitation-of-cve-2023-20938-article-2-6215160e3373", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-part-3-67d5aaa8.txt" }, { "label": "part 4", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-fuzzing-binder-with-linux-kernel-library-lkl-article-3-62e931161eb5", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-part-4-a8e97e33.txt" }, { "label": "part 5", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-results-conclusion-d7143057408f", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-part-5-d3dde1e1.txt" } ] }, { "item_id": "d466ce7dfe417f54", "title": "Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938", "year": 2024, "authors": [ "Eugene Rodionov", "Zi Fan Tan", "and Gulshan Singh" ], "primary_url": "https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/", "summary_zh": "本文分析并利用与Android Binder漏洞相关的CVE-2023-20938。", "summary_en": "This article analyzes and exploits CVE-2023-20938 related to Android Binder vulnerabilities.", "source_markdown": "[2024: \"Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938\" by Eugene Rodionov, Zi Fan Tan, and Gulshan Singh](https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/) [article] [CVE-2023-20938]", "affected_area": "Binder", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/", "raw_path": "/raw/2024-vulnerabilities-lpe-attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938-primary-3f5860df.txt" } ] }, { "item_id": "d264b54439c28203", "title": "How to Fuzz Your Way to Android Universal Root: Attacking Android Binder", "year": 2024, "authors": [ "Eugene Rodionov", "Zi Fan Tan" ], "primary_url": "https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/offensivecon_24_binder.pdf", "summary_zh": "本演示讨论了针对Android Binder漏洞的模糊测试技术。", "summary_en": "This presentation discusses fuzzing techniques targeting Android Binder vulnerabilities.", "source_markdown": "[2024: \"How to Fuzz Your Way to Android Universal Root: Attacking Android Binder\" by Eugene Rodionov and Zi Fan Tan](https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/offensivecon_24_binder.pdf) [slides] [[video](https://www.youtube.com/watch?v=U-xSM159YLI)] [CVE-2023-20938]", "affected_area": "Binder", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "slides", "url": "https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/offensivecon_24_binder.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-how-to-fuzz-your-way-to-android-universal-root-attacking-android-binder-primary-8ea42.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=U-xSM159YLI", "raw_path": "/raw/2024-vulnerabilities-lpe-how-to-fuzz-your-way-to-android-universal-root-attacking-android-binder-video-94283fc.txt" } ] } ], "rank": 13 }, { "cve": "CVE-2026-43500", "year": 2026, "name": "Dirty Frag", "named_from_title": true, "name_source_title": "Dirty Frag", "discussion_count": 3, "resource_count": 5, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "a2f08dbcf22ae73e", "title": "Dirty Frag", "year": 2026, "authors": [ "Hyunwoo Kim" ], "primary_url": "https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md", "summary_zh": "Dirty Frag 是一个影响权限提升的 Linux 内核漏洞。", "summary_en": "Dirty Frag is a Linux kernel vulnerability affecting privilege escalation.", "source_markdown": "[2026: \"Dirty Frag\" by Hyunwoo Kim](https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md) [article] [[exploit](https://github.com/V4bel/dirtyfrag)] [CVE-2026-43284] [CVE-2026-43500] [Dirty Frag]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md", "raw_path": "/raw/2026-vulnerabilities-lpe-dirty-frag-primary-396fb7de.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/V4bel/dirtyfrag", "raw_path": "/raw/2026-vulnerabilities-lpe-dirty-frag-exploit-30741dd1.txt" } ] }, { "item_id": "69e7947bd8dfb242", "title": "Discovery and Disclosure of an RxGK Variant in the Linux Kernel Privilege Escalation Vulnerability Family \"Dirty Frag", "year": 2026, "authors": [], "primary_url": "https://ikotaslabs.com/news/2026-05-11?lang=en", "summary_zh": "发现并披露了 Dirty Frag 漏洞家族中的 RxGK 变种。", "summary_en": "Discovery and Disclosure of an RxGK Variant in the Dirty Frag vulnerability family.", "source_markdown": "[2026: \"Discovery and Disclosure of an RxGK Variant in the Linux Kernel Privilege Escalation Vulnerability Family \\\"Dirty Frag\\\"\"](https://ikotaslabs.com/news/2026-05-11?lang=en) [article] [CVE-2026-43500] [Dirty Frag]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://ikotaslabs.com/news/2026-05-11?lang=en", "raw_path": "/raw/2026-vulnerabilities-lpe-discovery-and-disclosure-of-an-rxgk-variant-in-the-linux-kernel-privilege-escalation-.txt" } ] }, { "item_id": "ee4bf0c92071d49d", "title": "Load-Bearing Assumptions: the rxrpc case (CVE-2026-43500) and the constraint that was never there", "year": 2026, "authors": [ "Massimiliano Oldani" ], "primary_url": "https://www.linkedin.com/pulse/load-bearing-assumptions-rxrpc-case-cve-2026-43500-never-oldani-uzyae/", "summary_zh": "Load-Bearing Assumptions 讨论了与 Dirty Frag 漏洞相关的 rxrpc 案例。", "summary_en": "Load-Bearing Assumptions discusses the rxrpc case related to the Dirty Frag vulnerability.", "source_markdown": "[2026: \"Load-Bearing Assumptions: the rxrpc case (CVE-2026-43500) and the constraint that was never there\" by Massimiliano Oldani](https://www.linkedin.com/pulse/load-bearing-assumptions-rxrpc-case-cve-2026-43500-never-oldani-uzyae/) [article] [[exploit](https://github.com/sgkdev/rxrpc_privesc)] [CVE-2026-43500] [Dirty Frag]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.linkedin.com/pulse/load-bearing-assumptions-rxrpc-case-cve-2026-43500-never-oldani-uzyae/", "raw_path": "/raw/2026-vulnerabilities-lpe-load-bearing-assumptions-the-rxrpc-case-cve-2026-43500-and-the-constraint-that-was-ne.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/sgkdev/rxrpc_privesc", "raw_path": "/raw/2026-vulnerabilities-lpe-load-bearing-assumptions-the-rxrpc-case-cve-2026-43500-and-the-constraint-that-was-ne-2.txt" } ] } ], "rank": 14 }, { "cve": "CVE-2024-23380", "year": 2024, "name": "GPUAF", "named_from_title": true, "name_source_title": "GPUAF - Two ways of Rooting All Qualcomm based Android phones", "discussion_count": 3, "resource_count": 4, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Qualcomm GPU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025, 2024 ], "items": [ { "item_id": "e4c5620907bf0289", "title": "Introduction to Android GPU Vulnerability Attack and Defense", "year": 2025, "authors": [], "primary_url": "https://dawnslab.jd.com/android_gpu_attack_defence_introduction/", "summary_zh": "2025 年 Linux 内核LPE资料：「Introduction to Android GPU Vulnerability Attack and Defense」（CVE-2024-23380）；URL 类型：article。 Android 影响：yes。", "summary_en": "2025 Linux kernel LPE resource \"Introduction to Android GPU Vulnerability Attack and Defense\" (CVE-2024-23380); URL type: article. Android impact: yes.", "source_markdown": "[2025: \"Introduction to Android GPU Vulnerability Attack and Defense\"](https://dawnslab.jd.com/android_gpu_attack_defence_introduction/) [article] [CVE-2024-23380]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://dawnslab.jd.com/android_gpu_attack_defence_introduction/", "raw_path": "/raw/2025-vulnerabilities-lpe-introduction-to-android-gpu-vulnerability-attack-and-defense-primary-06037190.txt" } ] }, { "item_id": "e1cfe8e8185c505b", "title": "GPUAF - Two ways of Rooting All Qualcomm based Android phones", "year": 2024, "authors": [ "Pan Zhenpeng", "Jheng Bing Jhong" ], "primary_url": "https://powerofcommunity.net/poc2024/Pan%20Zhenpeng%20&%20Jheng%20Bing%20Jhong,%20GPUAF%20-%20Two%20ways%20of%20rooting%20All%20Qualcomm%20based%20Android%20phones.pdf", "summary_zh": "2024 年 Linux 内核LPE资料：「GPUAF - Two ways of Rooting All Qualcomm based Android phones」（CVE-2024-23380、CVE-2024-23373）；URL 类型：slides。 Android 影响：yes。", "summary_en": "2024 Linux kernel LPE resource \"GPUAF - Two ways of Rooting All Qualcomm based Android phones\" (CVE-2024-23380, CVE-2024-23373); URL type: slides. Android impact: yes.", "source_markdown": "[2024: \"GPUAF - Two ways of Rooting All Qualcomm based Android phones\" by Pan Zhenpeng and Jheng Bing Jhong](https://powerofcommunity.net/poc2024/Pan%20Zhenpeng%20&%20Jheng%20Bing%20Jhong,%20GPUAF%20-%20Two%20ways%20of%20rooting%20All%20Qualcomm%20based%20Android%20phones.pdf) [slides] [CVE-2024-23380] [CVE-2024-23373]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://powerofcommunity.net/poc2024/Pan%20Zhenpeng%20&%20Jheng%20Bing%20Jhong,%20GPUAF%20-%20Two%20ways%20of%20rooting%20All%20Qualcomm%20based%20Android%20phones.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-gpuaf-two-ways-of-rooting-all-qualcomm-based-android-phones-primary-a6ad2ff2.txt" } ] }, { "item_id": "87665b6d12c926cf", "title": "The Way to Android Root: Exploiting Your GPU On Smartphone", "year": 2024, "authors": [ "Xiling Gong", "Xuan Xing", "and Eugene Rodionov" ], "primary_url": "https://i.blackhat.com/BH-US-24/Presentations/REVISED02-US24-Gong-The-Way-to-Android-Root-Wednesday.pdf", "summary_zh": "关于利用GPU漏洞获取Android根访问权限的幻灯片。", "summary_en": "Slides on exploiting GPU vulnerabilities for Android root access.", "source_markdown": "[2024: \"The Way to Android Root: Exploiting Your GPU On Smartphone\" by Xiling Gong, Xuan Xing, and Eugene Rodionov](https://i.blackhat.com/BH-US-24/Presentations/REVISED02-US24-Gong-The-Way-to-Android-Root-Wednesday.pdf) [slides] [[video](https://www.youtube.com/watch?v=BN07rjaNqXk)] [CVE-2024-23380]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/BH-US-24/Presentations/REVISED02-US24-Gong-The-Way-to-Android-Root-Wednesday.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-the-way-to-android-root-exploiting-your-gpu-on-smartphone-primary-7b2f014c.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=BN07rjaNqXk", "raw_path": "/raw/2024-vulnerabilities-lpe-the-way-to-android-root-exploiting-your-gpu-on-smartphone-video-38fcd836.txt" } ] } ], "rank": 15 }, { "cve": "CVE-2020-0423", "year": 2020, "name": "Typhoon Mangkhut", "named_from_title": true, "name_source_title": "Typhoon Mangkhut: One-click Remote Universal Root Formed with Two Vulnerabilities", "discussion_count": 3, "resource_count": 4, "component_id": "android-ipc", "component_label": "Android IPC / Binder", "component_detail": "Binder race condition", "kernel_location": "drivers/android/", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021, 2020 ], "items": [ { "item_id": "955ed90be0a4a6f2", "title": "Escape from chrome sandbox to root", "year": 2021, "authors": [], "primary_url": "https://vul.360.net/archives/217", "summary_zh": "该文章描述了一种从Chrome沙箱逃逸到root的方法。", "summary_en": "The article describes a method to escape from the Chrome sandbox to root.", "source_markdown": "[2021: \"Escape from chrome sandbox to root\"](https://vul.360.net/archives/217) [article] [CVE-2020-0423]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://vul.360.net/archives/217", "raw_path": "/raw/2021-vulnerabilities-lpe-escape-from-chrome-sandbox-to-root-primary-a895bc16.txt" } ] }, { "item_id": "cae1d8c3c88335d2", "title": "Typhoon Mangkhut: One-click Remote Universal Root Formed with Two Vulnerabilities", "year": 2021, "authors": [], "primary_url": "https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Typhoon-Mangkhut-One-Click-Remote-Universal-Root-Formed-With-Two-Vulnerabilities.pdf", "summary_zh": "CVE-2020-0423涉及可能导致本地权限提升的漏洞。", "summary_en": "CVE-2020-0423 involves vulnerabilities that can lead to local privilege escalation.", "source_markdown": "[2021: \"Typhoon Mangkhut: One-click Remote Universal Root Formed with Two Vulnerabilities\"](https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Typhoon-Mangkhut-One-Click-Remote-Universal-Root-Formed-With-Two-Vulnerabilities.pdf) [slides] [[video](https://www.youtube.com/watch?v=a1vyt6iWmS4)] [CVE-2020-0423]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Typhoon-Mangkhut-One-Click-Remote-Universal-Root-Formed-With-Two-Vulnerabilities.pdf", "raw_path": "/raw/2021-vulnerabilities-lpe-typhoon-mangkhut-one-click-remote-universal-root-formed-with-two-vulnerabilities-prim.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=a1vyt6iWmS4", "raw_path": "/raw/2021-vulnerabilities-lpe-typhoon-mangkhut-one-click-remote-universal-root-formed-with-two-vulnerabilities-vide.txt" } ] }, { "item_id": "b6ed4c3093e5b63f", "title": "Exploiting a Single Instruction Race Condition in Binder", "year": 2020, "authors": [], "primary_url": "https://blog.longterm.io/cve-2020-0423.html", "summary_zh": "2020 年 Linux 内核LPE资料：「Exploiting a Single Instruction Race Condition in Binder」（CVE-2020-0423）；URL 类型：article。 Android 影响：possible。", "summary_en": "2020 Linux kernel LPE resource \"Exploiting a Single Instruction Race Condition in Binder\" (CVE-2020-0423); URL type: article. Android impact: possible.", "source_markdown": "[2020: \"Exploiting a Single Instruction Race Condition in Binder\"](https://blog.longterm.io/cve-2020-0423.html) [article] [CVE-2020-0423]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Binder, a core Android IPC driver", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.longterm.io/cve-2020-0423.html", "raw_path": "/raw/2020-vulnerabilities-lpe-exploiting-a-single-instruction-race-condition-in-binder-primary-aa0eb539.txt" } ] } ], "rank": 16 }, { "cve": "CVE-2022-34918", "year": 2022, "name": "A crack in the Linux firewall", "named_from_title": false, "name_source_title": "[CVE-2022-34918] A crack in the Linux firewall", "discussion_count": 3, "resource_count": 4, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "c0d87b682f728fee", "title": "[CVE-2022-34918] A crack in the Linux firewall", "year": 2022, "authors": [ "Arthur Mongodin" ], "primary_url": "https://www.randorisec.fr/crack-linux-firewall/", "summary_zh": "一篇分析Linux防火墙漏洞的文章。", "summary_en": "An article analyzing a vulnerability in the Linux firewall.", "source_markdown": "[2022: \"[CVE-2022-34918] A crack in the Linux firewall\" by Arthur Mongodin](https://www.randorisec.fr/crack-linux-firewall/) [article] [CVE-2022-34918] [[exploit](https://github.com/randorisec/CVE-2022-34918-LPE-PoC)]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.randorisec.fr/crack-linux-firewall/", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-34918-a-crack-in-the-linux-firewall-primary-54d759a2.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/randorisec/CVE-2022-34918-LPE-PoC", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-34918-a-crack-in-the-linux-firewall-exploit-3fdb73e0.txt" } ] }, { "item_id": "906bb555a71c5ade", "title": "CVE-2022-34918: netfilter analysis notes", "year": 2022, "authors": [], "primary_url": "https://veritas501.github.io/2022_08_02-CVE-2022-34918%20netfilter%20%E5%88%86%E6%9E%90%E7%AC%94%E8%AE%B0/", "summary_zh": "一篇提供Linux防火墙漏洞分析笔记的文章。", "summary_en": "An article providing analysis notes on a Linux firewall vulnerability.", "source_markdown": "[2022: \"CVE-2022-34918: netfilter analysis notes\"](https://veritas501.github.io/2022_08_02-CVE-2022-34918%20netfilter%20%E5%88%86%E6%9E%90%E7%AC%94%E8%AE%B0/) [article] [CVE-2022-34918]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://veritas501.github.io/2022_08_02-CVE-2022-34918%20netfilter%20%E5%88%86%E6%9E%90%E7%AC%94%E8%AE%B0/", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-34918-netfilter-analysis-notes-primary-7976d1ab.txt" } ] }, { "item_id": "15a55d430ce6d811", "title": "Practice of USMA-based Kernel Universal EXP Writing Ideas on CVE-2022-34918", "year": 2022, "authors": [], "primary_url": "https://veritas501.github.io/2022_08_11_%E5%9F%BA%E4%BA%8EUSMA%E7%9A%84%E5%86%85%E6%A0%B8%E9%80%9A%E7%94%A8EXP%E7%BC%96%E5%86%99%E6%80%9D%E8%B7%AF%E5%9C%A8%20CVE-2022-34918%20%E4%B8%8A%E7%9A%84%E5%AE%9E%E8%B7%B5/", "summary_zh": "一篇讨论基于CVE-2022-34918的内核利用编写思路的文章。", "summary_en": "An article discussing kernel exploit writing ideas based on CVE-2022-34918.", "source_markdown": "[2022: \"Practice of USMA-based Kernel Universal EXP Writing Ideas on CVE-2022-34918\"](https://veritas501.github.io/2022_08_11_%E5%9F%BA%E4%BA%8EUSMA%E7%9A%84%E5%86%85%E6%A0%B8%E9%80%9A%E7%94%A8EXP%E7%BC%96%E5%86%99%E6%80%9D%E8%B7%AF%E5%9C%A8%20CVE-2022-34918%20%E4%B8%8A%E7%9A%84%E5%AE%9E%E8%B7%B5/) [article] [CVE-2022-34918]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://veritas501.github.io/2022_08_11_%E5%9F%BA%E4%BA%8EUSMA%E7%9A%84%E5%86%85%E6%A0%B8%E9%80%9A%E7%94%A8EXP%E7%BC%96%E5%86%99%E6%80%9D%E8%B7%AF%E5%9C%A8%20CVE-2022-34918%20%E4%B8%8A%E7%9A%84%E5%AE%9E%E8%B7%B5/", "raw_path": "/raw/2022-vulnerabilities-lpe-practice-of-usma-based-kernel-universal-exp-writing-ideas-on-cve-2022-34918-primary-7.txt" } ] } ], "rank": 17 }, { "cve": "CVE-2023-26083", "year": 2023, "name": "Analyzing a Modern In-the-wild Android Exploit", "named_from_title": false, "name_source_title": "Analyzing a Modern In-the-wild Android Exploit", "discussion_count": 3, "resource_count": 3, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Mali GPU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025, 2024, 2023 ], "items": [ { "item_id": "96927e08f93d75e6", "title": "Solo: A Pixel 6 Pro Story (When one bug is all you need)", "year": 2025, "authors": [ "Lin Ze Wei" ], "primary_url": "https://starlabs.sg/blog/2025/06-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need/", "summary_zh": "2025 年 Linux 内核LPE资料：「Solo: A Pixel 6 Pro Story (When one bug is all you need)」（CVE-2023-48409、CVE-2023-26083）；URL 类型：article。 Android 影响：yes。", "summary_en": "2025 Linux kernel LPE resource \"Solo: A Pixel 6 Pro Story (When one bug is all you need)\" (CVE-2023-48409, CVE-2023-26083); URL type: article. Android impact: yes.", "source_markdown": "[2025: \"Solo: A Pixel 6 Pro Story (When one bug is all you need)\" by Lin Ze Wei](https://starlabs.sg/blog/2025/06-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need/) [article] [CVE-2023-48409] [CVE-2023-26083]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Pixel devices", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://starlabs.sg/blog/2025/06-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need/", "raw_path": "/raw/2025-vulnerabilities-lpe-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need-primary-a0052dd5.txt" } ] }, { "item_id": "7a5f07c73d6e2cb8", "title": "Mali GPU Kernel LPE: Android 14 kernel exploit for Pixel7/8 Pro", "year": 2024, "authors": [ "Mohamed Ghannam" ], "primary_url": "https://github.com/0x36/Pixel_GPU_Exploit", "summary_zh": "关于Android 14中Mali GPU驱动程序的本地特权升级漏洞的文章。", "summary_en": "An article on a local privilege escalation vulnerability in the Mali GPU driver for Android 14.", "source_markdown": "[2024: \"Mali GPU Kernel LPE: Android 14 kernel exploit for Pixel7/8 Pro\" by Mohamed Ghannam](https://github.com/0x36/Pixel_GPU_Exploit) [article] [CVE-2023-26083]", "affected_area": "driver", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/0x36/Pixel_GPU_Exploit", "raw_path": "/raw/2024-vulnerabilities-lpe-mali-gpu-kernel-lpe-android-14-kernel-exploit-for-pixel7-8-pro-primary-52f095a7.txt" } ] }, { "item_id": "15b138d05d0d017f", "title": "Analyzing a Modern In-the-wild Android Exploit", "year": 2023, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html", "summary_zh": "2023 年 Linux 内核LPE资料：「Analyzing a Modern In-the-wild Android Exploit」（CVE-2023-0266、CVE-2023-26083）；URL 类型：article。 Android 影响：yes。", "summary_en": "2023 Linux kernel LPE resource \"Analyzing a Modern In-the-wild Android Exploit\" (CVE-2023-0266, CVE-2023-26083); URL type: article. Android impact: yes.", "source_markdown": "[2023: \"Analyzing a Modern In-the-wild Android Exploit\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html) [article] [CVE-2023-0266] [CVE-2023-26083]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html", "raw_path": "/raw/2023-vulnerabilities-lpe-analyzing-a-modern-in-the-wild-android-exploit-primary-5bc9bddb.txt" } ] } ], "rank": 18 }, { "cve": "CVE-2022-22265", "year": 2022, "name": "Samsung npu driver", "named_from_title": false, "name_source_title": "CVE-2022-22265 Samsung npu driver", "discussion_count": 3, "resource_count": 3, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Samsung NPU driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024, 2023, 2022 ], "items": [ { "item_id": "e5e485388473c3be", "title": "CVE-2022-22265 Samsung npu driver", "year": 2024, "authors": [ "Javier P Rufo" ], "primary_url": "https://soez.github.io/posts/CVE-2022-22265-Samsung-npu-driver/", "summary_zh": "一篇详细介绍CVE-2022-22265的文章，这是一个三星npu驱动程序中的漏洞。", "summary_en": "An article detailing CVE-2022-22265, a vulnerability in the Samsung npu driver.", "source_markdown": "[2024: \"CVE-2022-22265 Samsung npu driver\" by Javier P Rufo](https://soez.github.io/posts/CVE-2022-22265-Samsung-npu-driver/) [article] [CVE-2022-22265]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions an Android OEM/device family", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://soez.github.io/posts/CVE-2022-22265-Samsung-npu-driver/", "raw_path": "/raw/2024-vulnerabilities-lpe-cve-2022-22265-samsung-npu-driver-primary-8f0a03ba.txt" } ] }, { "item_id": "b1cafe59e420c497", "title": "Attacking NPUs of Multiple Platforms", "year": 2023, "authors": [], "primary_url": "https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf", "summary_zh": "这些幻灯片涵盖了多个平台上与NPU相关的漏洞。", "summary_en": "The slides cover vulnerabilities related to NPUs across multiple platforms.", "source_markdown": "[2023: \"Attacking NPUs of Multiple Platforms\"](https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf) [slides] [CVE-2022-22265] [CVE-2020-28343] [SVE-2021-20204] [CVE-2023-42483] [CVE-2023-45864]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf", "raw_path": "/raw/2023-vulnerabilities-other-attacking-npus-of-multiple-platforms-primary-e362137b.txt" } ] }, { "item_id": "a44bf87e886bf0a4", "title": "CVE-2022-22265: Samsung NPU device driver double free in Android", "year": 2022, "authors": [ "Xingyu Jin" ], "primary_url": "https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22265.html", "summary_zh": "本文讨论了Android中Samsung NPU设备驱动的双重释放漏洞。", "summary_en": "This article discusses a double free vulnerability in the Samsung NPU device driver for Android.", "source_markdown": "[2022: \"CVE-2022-22265: Samsung NPU device driver double free in Android\" by Xingyu Jin](https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22265.html) [article] [CVE-2022-22265]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22265.html", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-22265-samsung-npu-device-driver-double-free-in-android-primary-fe4d868c.txt" } ] } ], "rank": 19 }, { "cve": "CVE-2024-50264", "year": 2024, "name": "Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel", "named_from_title": false, "name_source_title": "Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel", "discussion_count": 3, "resource_count": 3, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "0932996c56db5a63", "title": "Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel", "year": 2025, "authors": [ "Alexander Popov" ], "primary_url": "https://a13xp0p0v.github.io/2025/09/02/kernel-hack-drill-and-CVE-2024-50264.html", "summary_zh": "2025 年 Linux 内核LPE资料：「Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel」（CVE-2024-50264）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel\" (CVE-2024-50264); URL type: article.", "source_markdown": "[2025: \"Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel\" by Alexander Popov](https://a13xp0p0v.github.io/2025/09/02/kernel-hack-drill-and-CVE-2024-50264.html) [article] [CVE-2024-50264]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://a13xp0p0v.github.io/2025/09/02/kernel-hack-drill-and-CVE-2024-50264.html", "raw_path": "/raw/2025-vulnerabilities-lpe-kernel-hack-drill-and-a-new-approach-to-exploiting-cve-2024-50264-in-the-linux-kernel.txt" } ] }, { "item_id": "cc25a4ac4483ab08", "title": "Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits", "year": 2025, "authors": [ "Alexander Popov" ], "primary_url": "https://a13xp0p0v.github.io/img/Alexander_Popov-Kernel_Hack_Drill-Zer0Con.pdf", "summary_zh": "2025 年 Linux 内核LPE资料：「Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits」（CVE-2024-50264）；URL 类型：slides。", "summary_en": "2025 Linux kernel LPE resource \"Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits\" (CVE-2024-50264); URL type: slides.", "source_markdown": "[2025: \"Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits\" by Alexander Popov](https://a13xp0p0v.github.io/img/Alexander_Popov-Kernel_Hack_Drill-Zer0Con.pdf) [slides] [CVE-2024-50264]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://a13xp0p0v.github.io/img/Alexander_Popov-Kernel_Hack_Drill-Zer0Con.pdf", "raw_path": "/raw/2025-vulnerabilities-lpe-kernel-hack-drill-environment-for-developing-linux-kernel-exploits-primary-cb54f051.txt" } ] }, { "item_id": "66fa655ce4eb5f22", "title": "Race Condition Symphony: From Tiny Idea to Pwnie", "year": 2025, "authors": [ "Hyunwoo Kim", "Wongi Lee" ], "primary_url": "https://powerofcommunity.net/2025/slide/h-3938a.pdf", "summary_zh": "本演示讨论了导致Linux内核本地特权升级的竞争条件漏洞。", "summary_en": "This presentation discusses a race condition vulnerability leading to local privilege escalation in the Linux kernel.", "source_markdown": "[2025: \"Race Condition Symphony: From Tiny Idea to Pwnie\" by Hyunwoo Kim and Wongi Lee](https://powerofcommunity.net/2025/slide/h-3938a.pdf) [slides] [CVE-2024-50264]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://powerofcommunity.net/2025/slide/h-3938a.pdf", "raw_path": "/raw/2025-vulnerabilities-lpe-race-condition-symphony-from-tiny-idea-to-pwnie-primary-f8ee1665.txt" } ] } ], "rank": 20 }, { "cve": "CVE-2023-0386", "year": 2023, "name": "The OverlayFS vulnerability CVE-2023-0386: Overview, detection, and remediation", "named_from_title": false, "name_source_title": "The OverlayFS vulnerability CVE-2023-0386: Overview, detection, and remediation", "discussion_count": 3, "resource_count": 3, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem, VFS, or storage", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "f50b9d0a0d19730b", "title": "CVE-2023-0386 analysis and exploitation", "year": 2023, "authors": [ "chenaotian" ], "primary_url": "https://github.com/chenaotian/CVE-2023-0386", "summary_zh": "本文讨论了CVE-2023-0386的分析和利用技术。", "summary_en": "Analysis and exploitation techniques for CVE-2023-0386 are discussed in this article.", "source_markdown": "[2023: \"CVE-2023-0386 analysis and exploitation\" by chenaotian](https://github.com/chenaotian/CVE-2023-0386) [article] [CVE-2023-0386]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/chenaotian/CVE-2023-0386", "raw_path": "/raw/2023-vulnerabilities-lpe-cve-2023-0386-analysis-and-exploitation-primary-3a3edfec.txt" } ] }, { "item_id": "b27a8e084190baff", "title": "The OverlayFS vulnerability CVE-2023-0386: Overview, detection, and remediation", "year": 2023, "authors": [], "primary_url": "https://securitylabs.datadoghq.com/articles/overlayfs-cve-2023-0386/", "summary_zh": "本文提供了关于OverlayFS漏洞CVE-2023-0386的概述。", "summary_en": "This article provides an overview of the OverlayFS vulnerability CVE-2023-0386.", "source_markdown": "[2023: \"The OverlayFS vulnerability CVE-2023-0386: Overview, detection, and remediation\"](https://securitylabs.datadoghq.com/articles/overlayfs-cve-2023-0386/) [article] [CVE-2023-0386]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://securitylabs.datadoghq.com/articles/overlayfs-cve-2023-0386/", "raw_path": "/raw/2023-vulnerabilities-lpe-the-overlayfs-vulnerability-cve-2023-0386-overview-detection-and-remediation-primary-.txt" } ] }, { "item_id": "8bf487581c0dfa4f", "title": "xkaneiki/CVE-2023-0386", "year": 2023, "authors": [], "primary_url": "https://github.com/xkaneiki/CVE-2023-0386", "summary_zh": "CVE-2023-0386是一个可以被远程利用的Linux内核漏洞。", "summary_en": "CVE-2023-0386 is a Linux kernel vulnerability that can be exploited remotely.", "source_markdown": "https://github.com/xkaneiki/CVE-2023-0386", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/xkaneiki/CVE-2023-0386", "raw_path": "/raw/2023-exploits-xkaneiki-cve-2023-0386-primary-0e2fb77b.txt" } ] } ], "rank": 21 }, { "cve": "CVE-2022-2586", "year": 2022, "name": "N-day exploit for CVE-2022-2586: Linux kernel nft_object UAF", "named_from_title": false, "name_source_title": "N-day exploit for CVE-2022-2586: Linux kernel nft_object UAF", "discussion_count": 3, "resource_count": 3, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024, 2022 ], "items": [ { "item_id": "c57c54f903d46824", "title": "CVE-2022-2586 Writeup", "year": 2024, "authors": [], "primary_url": "https://jmpeax.dev/CVE-2022-2586-writeup.html", "summary_zh": "该写作提供了关于CVE-2022-2586及其影响的详细信息。", "summary_en": "This writeup provides details on CVE-2022-2586 and its implications.", "source_markdown": "[2024: \"CVE-2022-2586 Writeup\"](https://jmpeax.dev/CVE-2022-2586-writeup.html) [article] [CVE-2022-2586]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://jmpeax.dev/CVE-2022-2586-writeup.html", "raw_path": "/raw/2024-vulnerabilities-lpe-cve-2022-2586-writeup-primary-7a8c7b0a.txt" } ] }, { "item_id": "30c6280b9d06f522", "title": "Exploiting cross table object reference in Linux Netfilter table (NFT) module", "year": 2022, "authors": [], "primary_url": "https://docs.google.com/presentation/d/1qcPPz9E_X3z5h_E-Cc7Qmy1ppP4hWjFZQCQ5ZCb9hw8/edit?usp=sharing", "summary_zh": "介绍了Linux Netfilter模块中交叉表对象引用的利用技术。", "summary_en": "Exploitation techniques for cross table object references in the Linux Netfilter module are presented.", "source_markdown": "[2022: \"Exploiting cross table object reference in Linux Netfilter table (NFT) module\"](https://docs.google.com/presentation/d/1qcPPz9E_X3z5h_E-Cc7Qmy1ppP4hWjFZQCQ5ZCb9hw8/edit?usp=sharing) [slides] [CVE-2022-2078] [CVE-2022-2586]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://docs.google.com/presentation/d/1qcPPz9E_X3z5h_E-Cc7Qmy1ppP4hWjFZQCQ5ZCb9hw8/edit?usp=sharing", "raw_path": "/raw/2022-vulnerabilities-lpe-exploiting-cross-table-object-reference-in-linux-netfilter-table-nft-module-primary-7.txt" } ] }, { "item_id": "93df5f7489ac5900", "title": "N-day exploit for CVE-2022-2586: Linux kernel nft_object UAF", "year": 2022, "authors": [ "Alejandro Guerrero" ], "primary_url": "https://www.openwall.com/lists/oss-security/2022/08/29/5", "summary_zh": "本文描述了Linux内核UAF漏洞的N天利用。", "summary_en": "This article describes an N-day exploit for a Linux kernel UAF vulnerability.", "source_markdown": "[2022: \"N-day exploit for CVE-2022-2586: Linux kernel nft_object UAF\" by Alejandro Guerrero](https://www.openwall.com/lists/oss-security/2022/08/29/5) [article] [CVE-2022-2586]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.openwall.com/lists/oss-security/2022/08/29/5", "raw_path": "/raw/2022-vulnerabilities-lpe-n-day-exploit-for-cve-2022-2586-linux-kernel-nft-object-uaf-primary-1540d50e.txt" } ] } ], "rank": 22 }, { "cve": "CVE-2026-43284", "year": 2026, "name": "Dirty Frag", "named_from_title": true, "name_source_title": "Dirty Frag", "discussion_count": 2, "resource_count": 4, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "memory management or page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "4422c40198beaa72", "title": "copy fail 2: electric boogaloo", "year": 2026, "authors": [ "SiCk" ], "primary_url": "https://afflicted.sh/blog/posts/copy-fail-2.html", "summary_zh": "Copy fail 2: electric boogaloo 是关于 Dirty Frag 漏洞的后续文章。", "summary_en": "Copy fail 2: electric boogaloo is a follow-up article on the Dirty Frag vulnerability.", "source_markdown": "[2026: \"copy fail 2: electric boogaloo\" by SiCk](https://afflicted.sh/blog/posts/copy-fail-2.html) [article] [[exploit](https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo)] [CVE-2026-43284] [Dirty Frag]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://afflicted.sh/blog/posts/copy-fail-2.html", "raw_path": "/raw/2026-vulnerabilities-lpe-copy-fail-2-electric-boogaloo-primary-ae8cc805.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo", "raw_path": "/raw/2026-vulnerabilities-lpe-copy-fail-2-electric-boogaloo-exploit-b5963664.txt" } ] }, { "item_id": "a2f08dbcf22ae73e", "title": "Dirty Frag", "year": 2026, "authors": [ "Hyunwoo Kim" ], "primary_url": "https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md", "summary_zh": "Dirty Frag 是一个影响权限提升的 Linux 内核漏洞。", "summary_en": "Dirty Frag is a Linux kernel vulnerability affecting privilege escalation.", "source_markdown": "[2026: \"Dirty Frag\" by Hyunwoo Kim](https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md) [article] [[exploit](https://github.com/V4bel/dirtyfrag)] [CVE-2026-43284] [CVE-2026-43500] [Dirty Frag]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md", "raw_path": "/raw/2026-vulnerabilities-lpe-dirty-frag-primary-396fb7de.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/V4bel/dirtyfrag", "raw_path": "/raw/2026-vulnerabilities-lpe-dirty-frag-exploit-30741dd1.txt" } ] } ], "rank": 23 }, { "cve": "CVE-2024-44068", "year": 2024, "name": "Dirty Ptrace", "named_from_title": true, "name_source_title": "Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers", "discussion_count": 2, "resource_count": 3, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "mobile SoC or accelerator driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "medium", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025, 2024 ], "items": [ { "item_id": "3789ecba9ecdd6b5", "title": "Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers", "year": 2025, "authors": [ "Xingyu Jin", "Martijn Bogaard" ], "primary_url": "https://powerofcommunity.net/2025/slide/x-84592.pdf", "summary_zh": "Dirty Ptrace探讨了内核mmap处理程序中的未记录行为，导致本地特权提升。", "summary_en": "Dirty Ptrace explores undocumented behaviors in kernel mmap handlers leading to local privilege escalation.", "source_markdown": "[2025: \"Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers\" by Xingyu Jin and Martijn Bogaard](https://powerofcommunity.net/2025/slide/x-84592.pdf) [slides] [[video](https://www.youtube.com/watch?v=yAUJFrPjfCI)] [CVE-2024-44068] [CVE‑2025‑23244] [CVE-2025-8109] [CVE-2024-49739]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://powerofcommunity.net/2025/slide/x-84592.pdf", "raw_path": "/raw/2025-vulnerabilities-lpe-dirty-ptrace-exploiting-undocumented-behaviors-in-kernel-mmap-handlers-primary-d057fa.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=yAUJFrPjfCI", "raw_path": "/raw/2025-vulnerabilities-lpe-dirty-ptrace-exploiting-undocumented-behaviors-in-kernel-mmap-handlers-video-61b937db.txt" } ] }, { "item_id": "8e8bbda83ea3f932", "title": "CVE-2024-44068: Samsung m2m1shot_scaler0 device driver page use-after-free in Android", "year": 2024, "authors": [], "primary_url": "https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2024/CVE-2024-44068.html", "summary_zh": "CVE-2024-44068描述了Android中Samsung设备驱动程序的使用后释放漏洞。", "summary_en": "CVE-2024-44068 describes a use-after-free vulnerability in a Samsung device driver for Android.", "source_markdown": "[2024: \"CVE-2024-44068: Samsung m2m1shot_scaler0 device driver page use-after-free in Android\"](https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2024/CVE-2024-44068.html) [article] [CVE-2024-44068]", "affected_area": "device driver", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2024/CVE-2024-44068.html", "raw_path": "/raw/2024-vulnerabilities-other-cve-2024-44068-samsung-m2m1shot-scaler0-device-driver-page-use-after-free-in-androi.txt" } ] } ], "rank": 24 }, { "cve": "CVE-2023-6241", "year": 2023, "name": "Gaining kernel code execution on an MTE-enabled Pixel 8", "named_from_title": false, "name_source_title": "Gaining kernel code execution on an MTE-enabled Pixel 8", "discussion_count": 2, "resource_count": 3, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU IOMMU path", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025, 2024 ], "items": [ { "item_id": "30ce50bda1587a8d", "title": "Skin in the Game: Survival of GPU IOMMU Irregular Damage", "year": 2025, "authors": [ "Fish", "Ling Hanqin" ], "primary_url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "summary_zh": "2025 年 Linux 内核LPE资料：「Skin in the Game: Survival of GPU IOMMU Irregular Damage」（CVE-2022-38181、CVE-2023-6241、CVE-2023-33107、CVE-2024-23372、CVE-2024-31333）；URL 类型：video。", "summary_en": "2025 Linux kernel LPE resource \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" (CVE-2022-38181, CVE-2023-6241, CVE-2023-33107, CVE-2024-23372, CVE-2024-31333); URL type: video.", "source_markdown": "[2025: \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" by Fish and Ling Hanqin](https://www.youtube.com/watch?v=e4t_xYPOq9w) [video] [CVE-2022-38181] [CVE-2023-6241] [CVE-2023-33107] [CVE-2024-23372] [CVE-2024-31333]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "raw_path": "/raw/2025-vulnerabilities-lpe-skin-in-the-game-survival-of-gpu-iommu-irregular-damage-primary-da1ab36a.txt" } ] }, { "item_id": "1c204ec774897aac", "title": "Gaining kernel code execution on an MTE-enabled Pixel 8", "year": 2024, "authors": [ "Man Yue Mo" ], "primary_url": "https://github.blog/2024-03-18-gaining-kernel-code-execution-on-an-mte-enabled-pixel-8/", "summary_zh": "一篇详细介绍在MTE启用的Pixel 8设备上的本地特权升级漏洞的文章。", "summary_en": "An article detailing a local privilege escalation vulnerability on an MTE-enabled Pixel 8 device.", "source_markdown": "[2024: \"Gaining kernel code execution on an MTE-enabled Pixel 8\" by Man Yue Mo](https://github.blog/2024-03-18-gaining-kernel-code-execution-on-an-mte-enabled-pixel-8/) [article] [[exploit](https://github.com/github/securitylab/tree/main/SecurityExploits/Android/Mali/CVE_2023_6241)] [CVE-2023-6241]", "affected_area": "kernel", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://github.blog/2024-03-18-gaining-kernel-code-execution-on-an-mte-enabled-pixel-8/", "raw_path": "/raw/2024-vulnerabilities-lpe-gaining-kernel-code-execution-on-an-mte-enabled-pixel-8-primary-5b64c9d4.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/github/securitylab/tree/main/SecurityExploits/Android/Mali/CVE_2023_6241", "raw_path": "/raw/2024-vulnerabilities-lpe-gaining-kernel-code-execution-on-an-mte-enabled-pixel-8-exploit-31180d94.txt" } ] } ], "rank": 25 }, { "cve": "CVE-2025-21756", "year": 2025, "name": "Linux Kernel Exploitation: CVE-2025-21756: Attack of the Vsock", "named_from_title": false, "name_source_title": "Linux Kernel Exploitation: CVE-2025-21756: Attack of the Vsock", "discussion_count": 2, "resource_count": 3, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "800d77ff206f13d0", "title": "CVE-2025-21692 nday writeup", "year": 2025, "authors": [ "volticks" ], "primary_url": "https://volticks.github.io/CVE-2025-21692-nday-writeup/", "summary_zh": "2025 年 Linux 内核LPE资料：「CVE-2025-21692 nday writeup」（CVE-2025-21692、CVE-2025-21756）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"CVE-2025-21692 nday writeup\" (CVE-2025-21692, CVE-2025-21756); URL type: article.", "source_markdown": "[2025: \"CVE-2025-21692 nday writeup\" by volticks](https://volticks.github.io/CVE-2025-21692-nday-writeup/) [article] [[exploit](https://github.com/volticks/CVE-2025-21692-poc)] [CVE-2025-21756]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://volticks.github.io/CVE-2025-21692-nday-writeup/", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-21692-nday-writeup-primary-0ad97bd0.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/volticks/CVE-2025-21692-poc", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-21692-nday-writeup-exploit-e127e319.txt" } ] }, { "item_id": "e296c5129b2dcaf7", "title": "Linux Kernel Exploitation: CVE-2025-21756: Attack of the Vsock", "year": 2025, "authors": [ "Michael Hoefler" ], "primary_url": "https://hoefler.dev/articles/vsock.html", "summary_zh": "2025 年 Linux 内核LPE资料：「Linux Kernel Exploitation: CVE-2025-21756: Attack of the Vsock」（CVE-2025-21756）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"Linux Kernel Exploitation: CVE-2025-21756: Attack of the Vsock\" (CVE-2025-21756); URL type: article.", "source_markdown": "[2025: \"Linux Kernel Exploitation: CVE-2025-21756: Attack of the Vsock\" by Michael Hoefler](https://hoefler.dev/articles/vsock.html) [article] [CVE-2025-21756]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://hoefler.dev/articles/vsock.html", "raw_path": "/raw/2025-vulnerabilities-lpe-linux-kernel-exploitation-cve-2025-21756-attack-of-the-vsock-primary-5900d044.txt" } ] } ], "rank": 26 }, { "cve": "CVE-2025-39946", "year": 2025, "name": "Analysing a 1-day Vulnerability in the Linux Kernel's TLS Subsystem", "named_from_title": false, "name_source_title": "Analysing a 1-day Vulnerability in the Linux Kernel's TLS Subsystem", "discussion_count": 2, "resource_count": 3, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "ff2104701ade996a", "title": "Analysing a 1-day Vulnerability in the Linux Kernel's TLS Subsystem", "year": 2025, "authors": [ "Faith" ], "primary_url": "https://faith2dxy.xyz/2025-10-02/kCTF-TLS-nday-analysis/", "summary_zh": "本文分析了Linux内核TLS子系统中的一个日漏洞，允许本地特权升级。", "summary_en": "This article analyzes a one-day vulnerability in the Linux kernel's TLS subsystem that allows local privilege escalation.", "source_markdown": "[2025: \"Analysing a 1-day Vulnerability in the Linux Kernel's TLS Subsystem\" by Faith](https://faith2dxy.xyz/2025-10-02/kCTF-TLS-nday-analysis/) [article] [CVE-2025-39946] [[exploit](https://github.com/farazsth98/exploit-CVE-2025-39946)]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://faith2dxy.xyz/2025-10-02/kCTF-TLS-nday-analysis/", "raw_path": "/raw/2025-vulnerabilities-lpe-analysing-a-1-day-vulnerability-in-the-linux-kernel-s-tls-subsystem-primary-e561d2ee.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/farazsth98/exploit-CVE-2025-39946", "raw_path": "/raw/2025-vulnerabilities-lpe-analysing-a-1-day-vulnerability-in-the-linux-kernel-s-tls-subsystem-exploit-a7f7e3f2.txt" } ] }, { "item_id": "aa4a4e9def1f8a27", "title": "Analyze Linux Kernel 1-day 0aeb54ac", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/10/03/analyze-linux-kernel-1-day-0aeb54ac.html", "summary_zh": "2025 年 Linux 内核LPE资料：「Analyze Linux Kernel 1-day 0aeb54ac」（CVE-2025-39946）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"Analyze Linux Kernel 1-day 0aeb54ac\" (CVE-2025-39946); URL type: article.", "source_markdown": "[2025: \"Analyze Linux Kernel 1-day 0aeb54ac\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/10/03/analyze-linux-kernel-1-day-0aeb54ac.html) [article] [CVE-2025-39946]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/10/03/analyze-linux-kernel-1-day-0aeb54ac.html", "raw_path": "/raw/2025-vulnerabilities-lpe-analyze-linux-kernel-1-day-0aeb54ac-primary-bd8650bd.txt" } ] } ], "rank": 27 }, { "cve": "CVE-2024-36978", "year": 2024, "name": "Two Linux net/sched 1-day Analysis", "named_from_title": false, "name_source_title": "Two Linux net/sched 1-day Analysis", "discussion_count": 2, "resource_count": 3, "component_id": "net-sched", "component_label": "Network scheduler", "component_detail": "network scheduler", "kernel_location": "net/sched/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "18506cc47391fa1b", "title": "Two Linux net/sched 1-day Analysis", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/08/31/two-linux-net_sched-1-day-analysis.html", "summary_zh": "提供了对Linux net/sched漏洞的为期两天的分析。", "summary_en": "A two-day analysis of Linux net/sched vulnerabilities is provided.", "source_markdown": "[2024: \"Two Linux net/sched 1-day Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/08/31/two-linux-net_sched-1-day-analysis.html) [article] [CVE-2024-36978]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/08/31/two-linux-net_sched-1-day-analysis.html", "raw_path": "/raw/2024-vulnerabilities-other-two-linux-net-sched-1-day-analysis-primary-dfe70560.txt" } ] }, { "item_id": "dafee7a204c11214", "title": "Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel", "year": 2024, "authors": [ "Mingi Cho", "Wongi Lee" ], "primary_url": "https://www.hexacon.fr/slides/Cho_Lee-Utilizing_Cross-CPU_Allocation_to_Exploit_Preempt-Disabled_Linux_Kernel.pdf", "summary_zh": "幻灯片详细介绍了使用跨CPU分配技术利用禁用抢占的Linux内核。", "summary_en": "Slides detailing the exploitation of preempt-disabled Linux kernel using cross-CPU allocation techniques.", "source_markdown": "[2024: \"Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel\" by Mingi Cho and Wongi Lee](https://www.hexacon.fr/slides/Cho_Lee-Utilizing_Cross-CPU_Allocation_to_Exploit_Preempt-Disabled_Linux_Kernel.pdf) [slides] [CVE-2023-31248] [[video](https://www.youtube.com/watch?v=dUdU0lp35xU)] [CVE-2024-36978]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "slides", "url": "https://www.hexacon.fr/slides/Cho_Lee-Utilizing_Cross-CPU_Allocation_to_Exploit_Preempt-Disabled_Linux_Kernel.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-utilizing-cross-cpu-allocation-to-exploit-preempt-disabled-linux-kernel-primary-77685.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=dUdU0lp35xU", "raw_path": "/raw/2024-vulnerabilities-lpe-utilizing-cross-cpu-allocation-to-exploit-preempt-disabled-linux-kernel-video-2ffddc1.txt" } ] } ], "rank": 28 }, { "cve": "CVE-2024-41010", "year": 2024, "name": "Linux net/sched UAF 1-day Analysis", "named_from_title": false, "name_source_title": "CVE-2024-41010 - Linux net/sched UAF 1-day Analysis", "discussion_count": 2, "resource_count": 3, "component_id": "net-sched", "component_label": "Network scheduler", "component_detail": "network scheduler", "kernel_location": "net/sched/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "546a2559bdb857ae", "title": "CVE-2024-41010 - Linux net/sched UAF 1-day Analysis", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/07/29/cve-2024-41010-linux-net_sched-uaf-1-day-analysis.html", "summary_zh": "分享了对Linux net/sched UAF漏洞CVE-2024-41010的分析。", "summary_en": "An analysis of the Linux net/sched UAF vulnerability CVE-2024-41010 is shared.", "source_markdown": "[2024: \"CVE-2024-41010 - Linux net/sched UAF 1-day Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/07/29/cve-2024-41010-linux-net_sched-uaf-1-day-analysis.html) [article] [CVE-2024-41010]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/07/29/cve-2024-41010-linux-net_sched-uaf-1-day-analysis.html", "raw_path": "/raw/2024-vulnerabilities-other-cve-2024-41010-linux-net-sched-uaf-1-day-analysis-primary-19a9feb0.txt" } ] }, { "item_id": "a1597a964ad100f1", "title": "Unleashing a 0day: Pivoting Capabilities and Conquering the Linux Kernel", "year": 2024, "authors": [ "Pedro Pinto" ], "primary_url": "https://www.figma.com/deck/GyXCgKKy6rMuY7NVZtInjY/Unleadhing-a-Oday---Osec?node-id=13-225", "summary_zh": "2024 年 Linux 内核LPE资料：「Unleashing a 0day: Pivoting Capabilities and Conquering the Linux Kernel」（CVE-2024-41010）；URL 类型：slides。", "summary_en": "2024 Linux kernel LPE resource \"Unleashing a 0day: Pivoting Capabilities and Conquering the Linux Kernel\" (CVE-2024-41010); URL type: slides.", "source_markdown": "[2024: \"Unleashing a 0day: Pivoting Capabilities and Conquering the Linux Kernel\" by Pedro Pinto](https://www.figma.com/deck/GyXCgKKy6rMuY7NVZtInjY/Unleadhing-a-Oday---Osec?node-id=13-225) [slides] [[video](https://www.youtube.com/watch?v=bxJhlwGjwWQ)] [CVE-2024-41010]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://www.figma.com/deck/GyXCgKKy6rMuY7NVZtInjY/Unleadhing-a-Oday---Osec?node-id=13-225", "raw_path": "/raw/2024-vulnerabilities-lpe-unleashing-a-0day-pivoting-capabilities-and-conquering-the-linux-kernel-primary-15c97.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=bxJhlwGjwWQ", "raw_path": "/raw/2024-vulnerabilities-lpe-unleashing-a-0day-pivoting-capabilities-and-conquering-the-linux-kernel-video-1eb2237.txt" } ] } ], "rank": 29 }, { "cve": "CVE-2023-0461", "year": 2023, "name": "Exploiting a bug in the Linux kernel with Zig", "named_from_title": false, "name_source_title": "Exploiting a bug in the Linux kernel with Zig", "discussion_count": 2, "resource_count": 3, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025, 2023 ], "items": [ { "item_id": "37f03983d31270a1", "title": "Two Network-related vunlnerabilities Analysis", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/01/08/two-network-related-vulnerabilities-analysis.html", "summary_zh": "本文提供了对Linux内核中两个网络相关漏洞的分析。", "summary_en": "An analysis of two network-related vulnerabilities in the Linux kernel is provided in this article.", "source_markdown": "[2025: \"Two Network-related vunlnerabilities Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/01/08/two-network-related-vulnerabilities-analysis.html) [article] [CVE-2023-6932] [CVE-2023-0461]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/01/08/two-network-related-vulnerabilities-analysis.html", "raw_path": "/raw/2025-vulnerabilities-other-two-network-related-vunlnerabilities-analysis-primary-7c835ca0.txt" } ] }, { "item_id": "a400b919e8ce7f04", "title": "Exploiting a bug in the Linux kernel with Zig", "year": 2023, "authors": [ "Richard Palethorpe" ], "primary_url": "https://richiejp.com/linux-kernel-exploit-tls_context-uaf", "summary_zh": "讨论使用Zig利用Linux内核中的漏洞的文章。", "summary_en": "An article discussing the exploitation of a bug in the Linux kernel using Zig.", "source_markdown": "[2023: \"Exploiting a bug in the Linux kernel with Zig\" by Richard Palethorpe](https://richiejp.com/linux-kernel-exploit-tls_context-uaf) [article] [[video](https://www.youtube.com/watch?v=g7ATRgat0v4)] [CVE-2023-0461]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://richiejp.com/linux-kernel-exploit-tls_context-uaf", "raw_path": "/raw/2023-vulnerabilities-lpe-exploiting-a-bug-in-the-linux-kernel-with-zig-primary-26efe05a.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=g7ATRgat0v4", "raw_path": "/raw/2023-vulnerabilities-lpe-exploiting-a-bug-in-the-linux-kernel-with-zig-video-1507f265.txt" } ] } ], "rank": 30 }, { "cve": "CVE-2023-2598", "year": 2023, "name": "Conquering the memory through io_uring - Analysis of CVE-2023-2598", "named_from_title": false, "name_source_title": "Conquering the memory through io_uring - Analysis of CVE-2023-2598", "discussion_count": 2, "resource_count": 3, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "8569b381a4c365ff", "title": "3", "year": 2023, "authors": [], "primary_url": "https://www.openwall.com/lists/oss-security/2023/05/08/3", "summary_zh": "CVE-2023-2598是一个可以被远程利用的Linux内核漏洞。", "summary_en": "CVE-2023-2598 is a Linux kernel vulnerability that can be exploited remotely.", "source_markdown": "https://www.openwall.com/lists/oss-security/2023/05/08/3 [CVE-2023-2598]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.openwall.com/lists/oss-security/2023/05/08/3", "raw_path": "/raw/2023-exploits-3-primary-264b0234.txt" } ] }, { "item_id": "5fa7d2bd5177ab29", "title": "Conquering the memory through io_uring - Analysis of CVE-2023-2598", "year": 2023, "authors": [], "primary_url": "https://anatomic.rip/cve-2023-2598/", "summary_zh": "通过io_uring分析Linux内核中的本地特权升级漏洞。", "summary_en": "An analysis of a local privilege escalation vulnerability through io_uring in the Linux kernel.", "source_markdown": "[2023: \"Conquering the memory through io_uring - Analysis of CVE-2023-2598\"](https://anatomic.rip/cve-2023-2598/) [article] [[exploit](https://github.com/ysanatomic/io_uring_LPE-CVE-2023-2598)] [CVE-2023-2598]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://anatomic.rip/cve-2023-2598/", "raw_path": "/raw/2023-vulnerabilities-lpe-conquering-the-memory-through-io-uring-analysis-of-cve-2023-2598-primary-90beef7a.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/ysanatomic/io_uring_LPE-CVE-2023-2598", "raw_path": "/raw/2023-vulnerabilities-lpe-conquering-the-memory-through-io-uring-analysis-of-cve-2023-2598-exploit-68eb52f1.txt" } ] } ], "rank": 31 }, { "cve": "CVE-2022-0435", "year": 2022, "name": "A Remote Stack Overflow in The Linux", "named_from_title": false, "name_source_title": "CVE-2022-0435: A Remote Stack Overflow in The Linux", "discussion_count": 2, "resource_count": 3, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "fde78d6e6ca77366", "title": "CVE-2022-0435: A Remote Stack Overflow in The Linux", "year": 2022, "authors": [ "Samuel Page" ], "primary_url": "https://blog.immunityinc.com/p/a-remote-stack-overflow-in-the-linux-kernel/", "summary_zh": "讨论了Linux内核中的远程栈溢出漏洞CVE-2022-0435。", "summary_en": "Discusses a remote stack overflow vulnerability in the Linux kernel identified as CVE-2022-0435.", "source_markdown": "[2022: \"CVE-2022-0435: A Remote Stack Overflow in The Linux\" by Samuel Page](https://blog.immunityinc.com/p/a-remote-stack-overflow-in-the-linux-kernel/) [article] [CVE-2022-0435]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.immunityinc.com/p/a-remote-stack-overflow-in-the-linux-kernel/", "raw_path": "/raw/2022-vulnerabilities-other-cve-2022-0435-a-remote-stack-overflow-in-the-linux-primary-37c290db.txt" } ] }, { "item_id": "ddd1c26235ef88b3", "title": "Writing a Linux Kernel Remote in 2022", "year": 2022, "authors": [ "Samuel Page" ], "primary_url": "https://blog.immunityinc.com/p/writing-a-linux-kernel-remote-in-2022/", "summary_zh": "2022年编写Linux内核远程程序提供了远程代码执行漏洞的见解。", "summary_en": "Writing a Linux Kernel Remote in 2022 provides insights into remote code execution vulnerabilities.", "source_markdown": "[2022: \"Writing a Linux Kernel Remote in 2022\" by Samuel Page](https://blog.immunityinc.com/p/writing-a-linux-kernel-remote-in-2022/) [article] [[slides](https://conference.hitb.org/hitbsecconf2022sin/materials/D1T1%20-%20Erybody%20Gettin%20TIPC%20-%20Demystifying%20Remote%20Linux%20Kernel%20Exploitation%20-%20Sam%20Page.pdf)] [CVE-2022-0435]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.immunityinc.com/p/writing-a-linux-kernel-remote-in-2022/", "raw_path": "/raw/2022-vulnerabilities-rce-writing-a-linux-kernel-remote-in-2022-primary-ba11372f.txt" }, { "label": "slides", "type": "slides", "url": "https://conference.hitb.org/hitbsecconf2022sin/materials/D1T1%20-%20Erybody%20Gettin%20TIPC%20-%20Demystifying%20Remote%20Linux%20Kernel%20Exploitation%20-%20Sam%20Page.pdf", "raw_path": "/raw/2022-vulnerabilities-rce-writing-a-linux-kernel-remote-in-2022-slides-9d10d797.txt" } ] } ], "rank": 32 }, { "cve": "CVE-2022-23222", "year": 2022, "name": "tr3ee/CVE-2022-23222", "named_from_title": false, "name_source_title": "tr3ee/CVE-2022-23222", "discussion_count": 2, "resource_count": 3, "component_id": "ebpf", "component_label": "eBPF / verifier", "component_detail": "eBPF/verifier", "kernel_location": "kernel/bpf/ + net/core/filter.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024, 2022 ], "items": [ { "item_id": "3b20bb459935ccff", "title": "Linux eBPF Design and Vulnerability Case Study", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/07/12/linux-eBPF-design-and-vulnerability-case-study-part-1.html", "summary_zh": "提供了关于Linux eBPF设计和漏洞的案例研究。", "summary_en": "A case study on Linux eBPF design and vulnerabilities is presented.", "source_markdown": "[2024: \"Linux eBPF Design and Vulnerability Case Study\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/07/12/linux-eBPF-design-and-vulnerability-case-study-part-1.html) [article] [[part 2](https://u1f383.github.io/linux/2024/07/20/linux-eBPF-design-and-vulnerability-case-study-part-2.html)] [CVE-2024-41009] [CVE-2022-23222] [CVE-2023-52447]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/07/12/linux-eBPF-design-and-vulnerability-case-study-part-1.html", "raw_path": "/raw/2024-vulnerabilities-other-linux-ebpf-design-and-vulnerability-case-study-primary-661420eb.txt" }, { "label": "part 2", "type": "article", "url": "https://u1f383.github.io/linux/2024/07/20/linux-eBPF-design-and-vulnerability-case-study-part-2.html", "raw_path": "/raw/2024-vulnerabilities-other-linux-ebpf-design-and-vulnerability-case-study-part-2-1c7b257f.txt" } ] }, { "item_id": "e7db3ceeef019297", "title": "tr3ee/CVE-2022-23222", "year": 2022, "authors": [], "primary_url": "https://github.com/tr3ee/CVE-2022-23222", "summary_zh": "CVE-2022-23222是一个可以被远程利用的Linux内核漏洞。", "summary_en": "CVE-2022-23222 is a Linux kernel vulnerability that can be exploited remotely.", "source_markdown": "https://github.com/tr3ee/CVE-2022-23222", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/tr3ee/CVE-2022-23222", "raw_path": "/raw/2022-exploits-tr3ee-cve-2022-23222-primary-c86ac175.txt" } ] } ], "rank": 33 }, { "cve": "CVE-2025-38001", "year": 2025, "name": "Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: An RBTree Family Drama (Part One: LTS & C", "named_from_title": false, "name_source_title": "[CVE-2025-38001] Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: An RBTree Family Drama (Part One: LTS & COS)", "discussion_count": 2, "resource_count": 3, "component_id": "core-kernel", "component_label": "Core kernel / task lifetime", "component_detail": "core kernel lifetime or task path", "kernel_location": "kernel/ + fs/exec.c", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "b576a269b547b45d", "title": "[CVE-2025-38001] Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: An RBTree Family Drama (Part One: LTS & COS)", "year": 2025, "authors": [ "D3vil" ], "primary_url": "https://syst3mfailure.io/rbtree-family-drama/", "summary_zh": "一篇详细介绍在Google kernelCTF实例中利用本地特权升级漏洞的文章。", "summary_en": "An article detailing the exploitation of a local privilege escalation vulnerability in Google kernelCTF instances.", "source_markdown": "[2025: \"[CVE-2025-38001] Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: An RBTree Family Drama (Part One: LTS & COS)\" by D3vil](https://syst3mfailure.io/rbtree-family-drama/) [article] [CVE-2025-38001]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://syst3mfailure.io/rbtree-family-drama/", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-38001-exploiting-all-google-kernelctf-instances-and-debian-12-with-a-0-day-f.txt" } ] }, { "item_id": "05b0d3364fafe541", "title": "An RbTree Family Drama: Exploiting a Linux Kernel 0-day Through Red-Black Tree Transformations", "year": 2025, "authors": [ "Savino Dicanosa", "William Liu" ], "primary_url": "https://storage.googleapis.com/static.cor.team/assets/rbtree_family_drama_hexacon_2025.pdf", "summary_zh": "RbTree Family Drama演示通过红黑树转换探讨了Linux内核中的0天漏洞。", "summary_en": "The RbTree Family Drama presentation explores a 0-day vulnerability in the Linux kernel through red-black tree transformations.", "source_markdown": "[2025: \"An RbTree Family Drama: Exploiting a Linux Kernel 0-day Through Red-Black Tree Transformations\" by Savino Dicanosa and William Liu](https://storage.googleapis.com/static.cor.team/assets/rbtree_family_drama_hexacon_2025.pdf) [slides] [[video](https://www.youtube.com/watch?v=C-52Gwmce3w)] [CVE-2025-38001]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://storage.googleapis.com/static.cor.team/assets/rbtree_family_drama_hexacon_2025.pdf", "raw_path": "/raw/2025-vulnerabilities-lpe-an-rbtree-family-drama-exploiting-a-linux-kernel-0-day-through-red-black-tree-transfo.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=C-52Gwmce3w", "raw_path": "/raw/2025-vulnerabilities-lpe-an-rbtree-family-drama-exploiting-a-linux-kernel-0-day-through-red-black-tree-transfo-2.txt" } ] } ], "rank": 34 }, { "cve": "CVE-2023-0266", "year": 2023, "name": "Demo showing Claude Opus does not find CVE-2023-0266", "named_from_title": false, "name_source_title": "Demo showing Claude Opus does not find CVE-2023-0266", "discussion_count": 2, "resource_count": 2, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Mali GPU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024, 2023 ], "items": [ { "item_id": "128effebda7efe6d", "title": "Demo showing Claude Opus does not find CVE-2023-0266", "year": 2024, "authors": [ "Sean Heelan" ], "primary_url": "https://github.com/SeanHeelan/claude_opus_cve_2023_0266", "summary_zh": "2024 年 Linux 内核Misc资料：「Demo showing Claude Opus does not find CVE-2023-0266」（CVE-2023-0266）；URL 类型：article。", "summary_en": "2024 Linux kernel Misc resource \"Demo showing Claude Opus does not find CVE-2023-0266\" (CVE-2023-0266); URL type: article.", "source_markdown": "[2024: \"Demo showing Claude Opus does not find CVE-2023-0266\" by Sean Heelan](https://github.com/SeanHeelan/claude_opus_cve_2023_0266) [article]", "affected_area": "", "android_status": "no", "android_confirmed": false, "android_reason": "Not enough evidence that this resource maps to released Android devices.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/SeanHeelan/claude_opus_cve_2023_0266", "raw_path": "/raw/2024-misc-demo-showing-claude-opus-does-not-find-cve-2023-0266-primary-a73be521.txt" } ] }, { "item_id": "15b138d05d0d017f", "title": "Analyzing a Modern In-the-wild Android Exploit", "year": 2023, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html", "summary_zh": "2023 年 Linux 内核LPE资料：「Analyzing a Modern In-the-wild Android Exploit」（CVE-2023-0266、CVE-2023-26083）；URL 类型：article。 Android 影响：yes。", "summary_en": "2023 Linux kernel LPE resource \"Analyzing a Modern In-the-wild Android Exploit\" (CVE-2023-0266, CVE-2023-26083); URL type: article. Android impact: yes.", "source_markdown": "[2023: \"Analyzing a Modern In-the-wild Android Exploit\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html) [article] [CVE-2023-0266] [CVE-2023-26083]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html", "raw_path": "/raw/2023-vulnerabilities-lpe-analyzing-a-modern-in-the-wild-android-exploit-primary-5bc9bddb.txt" } ] } ], "rank": 35 }, { "cve": "CVE-2022-22706", "year": 2022, "name": "Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793", "named_from_title": false, "name_source_title": "Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)", "discussion_count": 2, "resource_count": 2, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Mali GPU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "8d4f27b8f2a1c824", "title": "Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)", "year": 2025, "authors": [ "Ng Zhi Yang" ], "primary_url": "https://starlabs.sg/blog/2025/12-mali-cious-intent-exploiting-gpu-vulnerabilities-cve-2022-22706/", "summary_zh": "2025 年 Linux 内核LPE资料：「Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)」（CVE-2022-22706、CVE-2021-39793）；URL 类型：article。 Android 影响：possible。", "summary_en": "2025 Linux kernel LPE resource \"Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)\" (CVE-2022-22706, CVE-2021-39793); URL type: article. Android impact: possible.", "source_markdown": "[2025: \"Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)\" by Ng Zhi Yang](https://starlabs.sg/blog/2025/12-mali-cious-intent-exploiting-gpu-vulnerabilities-cve-2022-22706/) [article] [CVE-2022-22706] [CVE-2021-39793]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions mobile SoC/GPU components used by Android devices", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://starlabs.sg/blog/2025/12-mali-cious-intent-exploiting-gpu-vulnerabilities-cve-2022-22706/", "raw_path": "/raw/2025-vulnerabilities-lpe-mali-cious-intent-exploiting-gpu-vulnerabilities-cve-2022-22706-cve-2021-39793-primar.txt" } ] }, { "item_id": "431efb63641ce456", "title": "Walkthrough of an N-day Android GPU driver vulnerability", "year": 2025, "authors": [ "Angus" ], "primary_url": "https://www.youtube.com/watch?v=G71dB0C4-dY", "summary_zh": "视频演示详细介绍了Android GPU驱动程序中的N天漏洞，导致本地特权提升。", "summary_en": "A video walkthrough details an N-day vulnerability in an Android GPU driver leading to local privilege escalation.", "source_markdown": "[2025: \"Walkthrough of an N-day Android GPU driver vulnerability\" by Angus](https://www.youtube.com/watch?v=G71dB0C4-dY) [video] [CVE-2022-22706]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=G71dB0C4-dY", "raw_path": "/raw/2025-vulnerabilities-lpe-walkthrough-of-an-n-day-android-gpu-driver-vulnerability-primary-e5212d3c.txt" } ] } ], "rank": 36 }, { "cve": "CVE-2021-0920", "year": 2021, "name": "The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I", "named_from_title": false, "name_source_title": "The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)", "discussion_count": 2, "resource_count": 2, "component_id": "core-kernel", "component_label": "Core kernel / task lifetime", "component_detail": "core kernel lifetime or task path", "kernel_location": "kernel/ + fs/exec.c", "component_confidence": "medium", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "123bf5e945963bb5", "title": "Monitoring Surveillance Vendors: A Deep Dive into In-the-Wild Android Full Chains in 2021", "year": 2022, "authors": [], "primary_url": "https://i.blackhat.com/USA-22/Wednesday/US-22-Jin-Monitoring-Surveillance-Vendors.pdf", "summary_zh": "关于2021年在野Android攻击链的幻灯片。", "summary_en": "Slides providing insights into in-the-wild Android exploit chains from 2021.", "source_markdown": "[2022: \"Monitoring Surveillance Vendors: A Deep Dive into In-the-Wild Android Full Chains in 2021\"](https://i.blackhat.com/USA-22/Wednesday/US-22-Jin-Monitoring-Surveillance-Vendors.pdf) [slides] [CVE-2021-0920]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/USA-22/Wednesday/US-22-Jin-Monitoring-Surveillance-Vendors.pdf", "raw_path": "/raw/2022-vulnerabilities-lpe-monitoring-surveillance-vendors-a-deep-dive-into-in-the-wild-android-full-chains-in-2.txt" } ] }, { "item_id": "e6620f84e00d9e72", "title": "The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)", "year": 2022, "authors": [ "Xingyu Jin" ], "primary_url": "https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html", "summary_zh": "对Linux内核垃圾收集漏洞CVE-2021-0920的分析。", "summary_en": "An analysis of the Linux kernel garbage collection vulnerability CVE-2021-0920.", "source_markdown": "[2022: \"The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)\" by Xingyu Jin](https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html) [article] [CVE-2021-0920]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html", "raw_path": "/raw/2022-vulnerabilities-other-the-quantum-state-of-linux-kernel-garbage-collection-cve-2021-0920-part-i-primary-0.txt" } ] } ], "rank": 37 }, { "cve": "CVE-2021-28663", "year": 2021, "name": "lntrx/CVE-2021-28663", "named_from_title": false, "name_source_title": "lntrx/CVE-2021-28663", "discussion_count": 2, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "e2d4bf9abe2fb236", "title": "Internal of the Android kernel backdoor vulnerability", "year": 2021, "authors": [], "primary_url": "https://vul.360.net/archives/263", "summary_zh": "该文章讨论了Android内核中的后门漏洞。", "summary_en": "This article discusses a backdoor vulnerability in the Android kernel.", "source_markdown": "[2021: \"Internal of the Android kernel backdoor vulnerability\"](https://vul.360.net/archives/263) [article] [CVE-2021-28663]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://vul.360.net/archives/263", "raw_path": "/raw/2021-vulnerabilities-lpe-internal-of-the-android-kernel-backdoor-vulnerability-primary-5e559b7b.txt" } ] }, { "item_id": "c2b3e6977736da39", "title": "lntrx/CVE-2021-28663", "year": 2021, "authors": [], "primary_url": "https://github.com/lntrx/CVE-2021-28663", "summary_zh": "CVE-2021-28663漏洞的利用代码。", "summary_en": "Exploit code for CVE-2021-28663 vulnerability.", "source_markdown": "https://github.com/lntrx/CVE-2021-28663", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/lntrx/CVE-2021-28663", "raw_path": "/raw/2021-exploits-lntrx-cve-2021-28663-primary-38800152.txt" } ] } ], "rank": 38 }, { "cve": "CVE-2021-28664", "year": 2021, "name": "Analysis and Exploitation of CVE-2021-28664 for Android Privilege Escalation", "named_from_title": false, "name_source_title": "Analysis and Exploitation of CVE-2021-28664 for Android Privilege Escalation", "discussion_count": 2, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023, 2021 ], "items": [ { "item_id": "0ebd071f20da9d81", "title": "Two bugs with one PoC: Roo2ng Pixel 6 from Android 12 to Android 1", "year": 2023, "authors": [ "Yong Wang" ], "primary_url": "https://i.blackhat.com/Asia-23/AS-23-WANG-Two-bugs-with-one-PoC-Rooting-Pixel-6-from-Android-12-to-Android-13.pdf", "summary_zh": "这些幻灯片讨论了利用两个漏洞来获取Pixel 6设备的root权限。", "summary_en": "The slides discuss exploiting two bugs to root a Pixel 6 device.", "source_markdown": "[2023: \"Two bugs with one PoC: Roo2ng Pixel 6 from Android 12 to Android 1\" by Yong Wang](https://i.blackhat.com/Asia-23/AS-23-WANG-Two-bugs-with-one-PoC-Rooting-Pixel-6-from-Android-12-to-Android-13.pdf) [slides] [CVE-2021-28664]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/Asia-23/AS-23-WANG-Two-bugs-with-one-PoC-Rooting-Pixel-6-from-Android-12-to-Android-13.pdf", "raw_path": "/raw/2023-vulnerabilities-lpe-two-bugs-with-one-poc-roo2ng-pixel-6-from-android-12-to-android-1-primary-0c23c1a2.txt" } ] }, { "item_id": "46d60a6093617410", "title": "Analysis and Exploitation of CVE-2021-28664 for Android Privilege Escalation", "year": 2021, "authors": [ "Bernard Lampe" ], "primary_url": "https://www.bernardlampe.com/pub/Grayshift-CVE-2021-28664.pdf", "summary_zh": "CVE-2021-28664是影响Android设备的本地权限提升漏洞。", "summary_en": "CVE-2021-28664 is a local privilege escalation vulnerability affecting Android devices.", "source_markdown": "[2021: \"Analysis and Exploitation of CVE-2021-28664 for Android Privilege Escalation\" by Bernard Lampe](https://www.bernardlampe.com/pub/Grayshift-CVE-2021-28664.pdf) [slides] [CVE-2021-28664]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://www.bernardlampe.com/pub/Grayshift-CVE-2021-28664.pdf", "raw_path": "/raw/2021-vulnerabilities-lpe-analysis-and-exploitation-of-cve-2021-28664-for-android-privilege-escalation-primary-.txt" } ] } ], "rank": 39 }, { "cve": "CVE-2023-33107", "year": 2023, "name": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "named_from_title": false, "name_source_title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "discussion_count": 2, "resource_count": 2, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Qualcomm/Mali GPU path", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025, 2023 ], "items": [ { "item_id": "30ce50bda1587a8d", "title": "Skin in the Game: Survival of GPU IOMMU Irregular Damage", "year": 2025, "authors": [ "Fish", "Ling Hanqin" ], "primary_url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "summary_zh": "2025 年 Linux 内核LPE资料：「Skin in the Game: Survival of GPU IOMMU Irregular Damage」（CVE-2022-38181、CVE-2023-6241、CVE-2023-33107、CVE-2024-23372、CVE-2024-31333）；URL 类型：video。", "summary_en": "2025 Linux kernel LPE resource \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" (CVE-2022-38181, CVE-2023-6241, CVE-2023-33107, CVE-2024-23372, CVE-2024-31333); URL type: video.", "source_markdown": "[2025: \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" by Fish and Ling Hanqin](https://www.youtube.com/watch?v=e4t_xYPOq9w) [video] [CVE-2022-38181] [CVE-2023-6241] [CVE-2023-33107] [CVE-2024-23372] [CVE-2024-31333]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "raw_path": "/raw/2025-vulnerabilities-lpe-skin-in-the-game-survival-of-gpu-iommu-irregular-damage-primary-da1ab36a.txt" } ] }, { "item_id": "384b71259a0bffc4", "title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "year": 2023, "authors": [ "Alisa Esage" ], "primary_url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "summary_zh": "本文提供了针对Qualcomm MSM Linux内核和ARM Mali GPU的最新0-day攻击的见解。", "summary_en": "This article provides insights into recent 0-day exploit attacks targeting Qualcomm MSM Linux Kernel and ARM Mali GPU.", "source_markdown": "[2023: \"Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023\" by Alisa Esage](https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html) [article] [CVE-2023-33063] [CVE-2023-33106] [CVE-2023-33107] [CVE-2022-22071] [CVE-2023-4211]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "raw_path": "/raw/2023-vulnerabilities-other-deep-dive-qualcomm-msm-linux-kernel-arm-mali-gpu-0-day-exploit-attacks-of-october-2.txt" } ] } ], "rank": 40 }, { "cve": "CVE-2022-38181", "year": 2022, "name": "Pwning the all Google phone with a non-Google bug", "named_from_title": false, "name_source_title": "Pwning the all Google phone with a non-Google bug", "discussion_count": 2, "resource_count": 2, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU IOMMU path", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025, 2023 ], "items": [ { "item_id": "30ce50bda1587a8d", "title": "Skin in the Game: Survival of GPU IOMMU Irregular Damage", "year": 2025, "authors": [ "Fish", "Ling Hanqin" ], "primary_url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "summary_zh": "2025 年 Linux 内核LPE资料：「Skin in the Game: Survival of GPU IOMMU Irregular Damage」（CVE-2022-38181、CVE-2023-6241、CVE-2023-33107、CVE-2024-23372、CVE-2024-31333）；URL 类型：video。", "summary_en": "2025 Linux kernel LPE resource \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" (CVE-2022-38181, CVE-2023-6241, CVE-2023-33107, CVE-2024-23372, CVE-2024-31333); URL type: video.", "source_markdown": "[2025: \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" by Fish and Ling Hanqin](https://www.youtube.com/watch?v=e4t_xYPOq9w) [video] [CVE-2022-38181] [CVE-2023-6241] [CVE-2023-33107] [CVE-2024-23372] [CVE-2024-31333]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "raw_path": "/raw/2025-vulnerabilities-lpe-skin-in-the-game-survival-of-gpu-iommu-irregular-damage-primary-da1ab36a.txt" } ] }, { "item_id": "d12f3351fd1b4e7c", "title": "Pwning the all Google phone with a non-Google bug", "year": 2023, "authors": [], "primary_url": "https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/", "summary_zh": "一篇详细介绍允许Google手机权限提升的非Google漏洞的文章。", "summary_en": "An article detailing a non-Google bug that allows privilege escalation on Google phones.", "source_markdown": "[2023: \"Pwning the all Google phone with a non-Google bug\"](https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/) [article] [CVE-2022-38181]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/", "raw_path": "/raw/2023-vulnerabilities-lpe-pwning-the-all-google-phone-with-a-non-google-bug-primary-6f6adf84.txt" } ] } ], "rank": 41 }, { "cve": "CVE-2022-3910", "year": 2022, "name": "Linux Kernel CVE-2022-3910 (h0mbre kCTF bug) LPE", "named_from_title": false, "name_source_title": "Linux Kernel CVE-2022-3910 (h0mbre kCTF bug) LPE", "discussion_count": 2, "resource_count": 2, "component_id": "virtualization", "component_label": "Virtualization / containers", "component_detail": "virtualization or isolation boundary", "kernel_location": "virt/ + arch/*/kvm/", "component_confidence": "medium", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2026, "article_years": [ 2026, 2023 ], "items": [ { "item_id": "bcd90185fbb63f83", "title": "Linux Kernel CVE-2022-3910 (h0mbre kCTF bug) LPE", "year": 2026, "authors": [], "primary_url": "https://www.slop4u.ai/Linux-Kernel-CVE-2022-3910-LPE/", "summary_zh": "这篇文章讨论了Linux内核中被识别为CVE-2022-3910的权限提升漏洞。", "summary_en": "This article discusses a privilege escalation vulnerability identified as CVE-2022-3910 in the Linux kernel.", "source_markdown": "[2026: \"Linux Kernel CVE-2022-3910 (h0mbre kCTF bug) LPE\"](https://www.slop4u.ai/Linux-Kernel-CVE-2022-3910-LPE/) [article] [CVE-2022-3910]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.slop4u.ai/Linux-Kernel-CVE-2022-3910-LPE/", "raw_path": "/raw/2026-vulnerabilities-lpe-linux-kernel-cve-2022-3910-h0mbre-kctf-bug-lpe-primary-43df0faa.txt" } ] }, { "item_id": "dba046acc3aa58ec", "title": "Escaping the Google kCTF Container with a Data-Only Exploit", "year": 2023, "authors": [ "h0mbre" ], "primary_url": "https://h0mbre.github.io/kCTF_Data_Only_Exploit/", "summary_zh": "分析影响多个CVE的现代野外Android利用的文章。", "summary_en": "An article analyzing a modern in-the-wild Android exploit affecting multiple CVEs.", "source_markdown": "[2023: \"Escaping the Google kCTF Container with a Data-Only Exploit\" by h0mbre](https://h0mbre.github.io/kCTF_Data_Only_Exploit/) [article] [CVE-2022-3910]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://h0mbre.github.io/kCTF_Data_Only_Exploit/", "raw_path": "/raw/2023-vulnerabilities-lpe-escaping-the-google-kctf-container-with-a-data-only-exploit-primary-afbe53f4.txt" } ] } ], "rank": 42 }, { "cve": "CVE-2026-46333", "year": 2026, "name": "0xdeadbeefnetwork/ssh-keysign-pwn", "named_from_title": false, "name_source_title": "0xdeadbeefnetwork/ssh-keysign-pwn", "discussion_count": 2, "resource_count": 2, "component_id": "core-kernel", "component_label": "Core kernel / task lifetime", "component_detail": "core kernel lifetime or task path", "kernel_location": "kernel/ + fs/exec.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "38b0e4acd752840b", "title": "0xdeadbeefnetwork/ssh-keysign-pwn", "year": 2026, "authors": [], "primary_url": "https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn", "summary_zh": "一个针对与ssh-keysign相关的CVE-2026-46333的漏洞利用。", "summary_en": "An exploit targeting CVE-2026-46333 related to ssh-keysign.", "source_markdown": "https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn [CVE-2026-46333]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn", "raw_path": "/raw/2026-exploits-0xdeadbeefnetwork-ssh-keysign-pwn-primary-970a1260.txt" } ] }, { "item_id": "af5a548bc62d4158", "title": "Logic bug in the Linux kernel's __ptrace_may_access() function", "year": 2026, "authors": [ "Qualys Research Team" ], "primary_url": "https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt", "summary_zh": "这篇文章强调了Linux内核ptrace函数中的逻辑错误，可能允许权限提升。", "summary_en": "This article highlights a logic bug in the Linux kernel's ptrace function that may allow privilege escalation.", "source_markdown": "[2026: \"Logic bug in the Linux kernel's __ptrace_may_access() function\" by Qualys Research Team](https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt) [article] [CVE-2026-46333]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt", "raw_path": "/raw/2026-vulnerabilities-lpe-logic-bug-in-the-linux-kernel-s-ptrace-may-access-function-primary-57e4d2de.txt" } ] } ], "rank": 43 }, { "cve": "CVE-2025-38617", "year": 2025, "name": "A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets", "named_from_title": false, "name_source_title": "A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets", "discussion_count": 2, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2026, "article_years": [ 2026, 2025 ], "items": [ { "item_id": "2753be49a7ee29b4", "title": "A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets", "year": 2026, "authors": [], "primary_url": "https://blog.calif.io/p/a-race-within-a-race-exploiting-cve", "summary_zh": "CVE-2025-38617在Linux数据包套接字中展示了导致本地特权提升的竞争条件漏洞。", "summary_en": "CVE-2025-38617 in Linux Packet Sockets demonstrates a race condition vulnerability leading to local privilege escalation.", "source_markdown": "[2026: \"A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets\"](https://blog.calif.io/p/a-race-within-a-race-exploiting-cve) [article] [CVE-2025-38617]", "affected_area": "Packet Sockets", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.calif.io/p/a-race-within-a-race-exploiting-cve", "raw_path": "/raw/2026-vulnerabilities-lpe-a-race-within-a-race-exploiting-cve-2025-38617-in-linux-packet-sockets-primary-603886.txt" } ] }, { "item_id": "99565929c2aed275", "title": "A Quick Note on CVE-2025-38617", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/08/27/a-quick-note-on-CVE-2025-38617.html", "summary_zh": "CVE-2025-38617是Linux中的一个已记录的漏洞。", "summary_en": "CVE-2025-38617 is a documented vulnerability in Linux.", "source_markdown": "[2025: \"A Quick Note on CVE-2025-38617\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/08/27/a-quick-note-on-CVE-2025-38617.html) [article] [CVE-2025-38617]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/08/27/a-quick-note-on-CVE-2025-38617.html", "raw_path": "/raw/2025-vulnerabilities-other-a-quick-note-on-cve-2025-38617-primary-8c702c5f.txt" } ] } ], "rank": 44 }, { "cve": "CVE-2024-36904", "year": 2024, "name": "Use-after-free vulnerability in the TCP subsystem of the Linux kernel", "named_from_title": false, "name_source_title": "CVE-2024-36904 - Use-after-free vulnerability in the TCP subsystem of the Linux kernel", "discussion_count": 2, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "8bf2d048df23890b", "title": "Accidentally uncovering a seven years old vulnerability in the Linux kernel", "year": 2025, "authors": [ "Anderson Nascimento" ], "primary_url": "https://allelesecurity.com/accidentally-uncovering-a-seven-years-old-vulnerability-in-the-linux-kernel/", "summary_zh": "在Linux内核中意外发现了一个七年的漏洞。", "summary_en": "A seven-year-old vulnerability in the Linux kernel was uncovered accidentally.", "source_markdown": "[2025: \"Accidentally uncovering a seven years old vulnerability in the Linux kernel\" by Anderson Nascimento](https://allelesecurity.com/accidentally-uncovering-a-seven-years-old-vulnerability-in-the-linux-kernel/) [article] [CVE-2024-36904]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://allelesecurity.com/accidentally-uncovering-a-seven-years-old-vulnerability-in-the-linux-kernel/", "raw_path": "/raw/2025-vulnerabilities-other-accidentally-uncovering-a-seven-years-old-vulnerability-in-the-linux-kernel-primary.txt" } ] }, { "item_id": "f80f4e2f6f6094a8", "title": "CVE-2024-36904 - Use-after-free vulnerability in the TCP subsystem of the Linux kernel", "year": 2025, "authors": [], "primary_url": "https://github.com/alleleintel/research/tree/master/CVE-2024-36904/", "summary_zh": "本文讨论了Linux内核TCP子系统中的使用后释放漏洞。", "summary_en": "The article discusses a use-after-free vulnerability in the TCP subsystem of the Linux kernel.", "source_markdown": "[2025: \"CVE-2024-36904 - Use-after-free vulnerability in the TCP subsystem of the Linux kernel\"](https://github.com/alleleintel/research/tree/master/CVE-2024-36904/) [article] [CVE-2024-36904]", "affected_area": "TCP subsystem", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/alleleintel/research/tree/master/CVE-2024-36904/", "raw_path": "/raw/2025-vulnerabilities-other-cve-2024-36904-use-after-free-vulnerability-in-the-tcp-subsystem-of-the-linux-kerne.txt" } ] } ], "rank": 45 }, { "cve": "CVE-2024-36974", "year": 2024, "name": "Linux Kernel taprio OOB", "named_from_title": false, "name_source_title": "Linux Kernel taprio OOB", "discussion_count": 2, "resource_count": 2, "component_id": "net-sched", "component_label": "Network scheduler", "component_detail": "network scheduler", "kernel_location": "net/sched/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "5e2874329f6584c7", "title": "Linux Kernel taprio OOB", "year": 2024, "authors": [], "primary_url": "https://ssd-disclosure.com/ssd-advisory-linux-kernel-taprio-oob/", "summary_zh": "一篇讨论Linux内核taprio子系统中的越界漏洞的文章。", "summary_en": "An article discussing an out-of-bounds vulnerability in the Linux Kernel taprio subsystem.", "source_markdown": "[2024: \"Linux Kernel taprio OOB\"](https://ssd-disclosure.com/ssd-advisory-linux-kernel-taprio-oob/) [article] [CVE-2024-36974]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://ssd-disclosure.com/ssd-advisory-linux-kernel-taprio-oob/", "raw_path": "/raw/2024-vulnerabilities-lpe-linux-kernel-taprio-oob-primary-0f233e8a.txt" } ] }, { "item_id": "ddabc644bf1348aa", "title": "Three Linux net/sched 1-day Analysis", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/09/05/three-linux-net_sched-1-day-analysis.html", "summary_zh": "讨论了三个Linux net/sched漏洞的为期一天的分析。", "summary_en": "A one-day analysis of three Linux net/sched vulnerabilities is discussed.", "source_markdown": "[2024: \"Three Linux net/sched 1-day Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/09/05/three-linux-net_sched-1-day-analysis.html) [article] [CVE-2024-36974] [CVE-2023-0590]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/09/05/three-linux-net_sched-1-day-analysis.html", "raw_path": "/raw/2024-vulnerabilities-other-three-linux-net-sched-1-day-analysis-primary-e5eae127.txt" } ] } ], "rank": 46 }, { "cve": "CVE-2024-53141", "year": 2024, "name": "an OOB Write Vulnerability in Netfiler Ipset", "named_from_title": false, "name_source_title": "CVE-2024-53141: an OOB Write Vulnerability in Netfiler Ipset", "discussion_count": 2, "resource_count": 2, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "84db342b8f74c581", "title": "CVE-2024-53141: an OOB Write Vulnerability in Netfiler Ipset", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/01/07/cve-2024-53141-an-oob-write-vulnerability-in-netfilter-ipset.html", "summary_zh": "2025 年 Linux 内核LPE资料：「CVE-2024-53141: an OOB Write Vulnerability in Netfiler Ipset」（CVE-2024-53141）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"CVE-2024-53141: an OOB Write Vulnerability in Netfiler Ipset\" (CVE-2024-53141); URL type: article.", "source_markdown": "[2025: \"CVE-2024-53141: an OOB Write Vulnerability in Netfiler Ipset\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/01/07/cve-2024-53141-an-oob-write-vulnerability-in-netfilter-ipset.html) [article] [CVE-2024-53141]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/01/07/cve-2024-53141-an-oob-write-vulnerability-in-netfilter-ipset.html", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2024-53141-an-oob-write-vulnerability-in-netfiler-ipset-primary-776d460b.txt" } ] }, { "item_id": "b0a0f51f7278e9be", "title": "netfilter: ipset: Missing Range Check LPE", "year": 2025, "authors": [], "primary_url": "https://ssd-disclosure.com/linux-kernel-netfilter-ipset-missing-range-check-lpe/", "summary_zh": "2025 年 Linux 内核LPE资料：「netfilter: ipset: Missing Range Check LPE」（CVE-2024-53141）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"netfilter: ipset: Missing Range Check LPE\" (CVE-2024-53141); URL type: article.", "source_markdown": "[2025: \"netfilter: ipset: Missing Range Check LPE\"](https://ssd-disclosure.com/linux-kernel-netfilter-ipset-missing-range-check-lpe/) [article] [CVE-2024-53141]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://ssd-disclosure.com/linux-kernel-netfilter-ipset-missing-range-check-lpe/", "raw_path": "/raw/2025-vulnerabilities-lpe-netfilter-ipset-missing-range-check-lpe-primary-aa4a1532.txt" } ] } ], "rank": 47 }, { "cve": "CVE-2023-32233", "year": 2023, "name": "Liuk3r/CVE-2023-32233", "named_from_title": false, "name_source_title": "Liuk3r/CVE-2023-32233", "discussion_count": 2, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "4899b24881e14010", "title": "5", "year": 2023, "authors": [], "primary_url": "https://www.openwall.com/lists/oss-security/2023/05/15/5", "summary_zh": "CVE-2023-32233是一个可以被远程利用的Linux内核漏洞。", "summary_en": "CVE-2023-32233 is a Linux kernel vulnerability that can be exploited remotely.", "source_markdown": "https://www.openwall.com/lists/oss-security/2023/05/15/5 [CVE-2023-32233]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.openwall.com/lists/oss-security/2023/05/15/5", "raw_path": "/raw/2023-exploits-5-primary-b4aa28a2.txt" } ] }, { "item_id": "bb0b3a72140f7771", "title": "Liuk3r/CVE-2023-32233", "year": 2023, "authors": [], "primary_url": "https://github.com/Liuk3r/CVE-2023-32233", "summary_zh": "CVE-2023-32233是一个可以被远程利用的Linux内核漏洞。", "summary_en": "CVE-2023-32233 is a Linux kernel vulnerability that can be exploited remotely.", "source_markdown": "https://github.com/Liuk3r/CVE-2023-32233", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/Liuk3r/CVE-2023-32233", "raw_path": "/raw/2023-exploits-liuk3r-cve-2023-32233-primary-0d0e1f96.txt" } ] } ], "rank": 48 }, { "cve": "CVE-2023-52922", "year": 2023, "name": "Use-after-free in CAN BCM subsystem leading to information disclosure (CVE-2023-52922", "named_from_title": false, "name_source_title": "Use-after-free in CAN BCM subsystem leading to information disclosure (CVE-2023-52922)", "discussion_count": 2, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "ad1afa7f90cc892f", "title": "Use-after-free in CAN BCM subsystem leading to information disclosure (CVE-2023-52922)", "year": 2025, "authors": [], "primary_url": "https://allelesecurity.com/use-after-free-vulnerability-in-can-bcm-subsystem-leading-to-information-disclosure-cve-2023-52922/", "summary_zh": "详细介绍了CAN BCM子系统中的使用后释放漏洞。", "summary_en": "Details a use-after-free vulnerability in the CAN BCM subsystem.", "source_markdown": "[2025: \"Use-after-free in CAN BCM subsystem leading to information disclosure (CVE-2023-52922)\"](https://allelesecurity.com/use-after-free-vulnerability-in-can-bcm-subsystem-leading-to-information-disclosure-cve-2023-52922/) [article] [CVE-2023-52922]", "affected_area": "CAN BCM", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://allelesecurity.com/use-after-free-vulnerability-in-can-bcm-subsystem-leading-to-information-disclosure-cve-2023-52922/", "raw_path": "/raw/2025-vulnerabilities-info-leaks-use-after-free-in-can-bcm-subsystem-leading-to-information-disclosure-cve-2023.txt" } ] }, { "item_id": "5f855ce5ab84addc", "title": "Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel", "year": 2025, "authors": [ "Anderson Nascimento" ], "primary_url": "https://allelesecurity.com/wp-content/uploads/2025/12/Presentation_307.pdf", "summary_zh": "介绍了CAN BCM协议中/proc组件的漏洞。", "summary_en": "Presents vulnerabilities in the /proc component of the CAN BCM protocol.", "source_markdown": "[2025: \"Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel\" by Anderson Nascimento](https://allelesecurity.com/wp-content/uploads/2025/12/Presentation_307.pdf) [slides] [CVE-2023-52922] [CVE-2025-38003] [CVE-2025-38004]", "affected_area": "/proc", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://allelesecurity.com/wp-content/uploads/2025/12/Presentation_307.pdf", "raw_path": "/raw/2025-vulnerabilities-info-leaks-vulnerabilities-in-the-proc-component-of-the-can-bcm-protocol-in-the-linux-ker.txt" } ] } ], "rank": 49 }, { "cve": "CVE-2022-0995", "year": 2022, "name": "PageJack", "named_from_title": true, "name_source_title": "PageJack in Action: CVE-2022-0995 exploit", "discussion_count": 2, "resource_count": 2, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "memory management or page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2026, "article_years": [ 2026, 2022 ], "items": [ { "item_id": "bfd2d62df4c6d763", "title": "PageJack in Action: CVE-2022-0995 exploit", "year": 2026, "authors": [ "Jean Vincent" ], "primary_url": "https://blog.quarkslab.com/pagejack-in-action-cve-2022-0995-exploit.html", "summary_zh": "这篇文章讨论了CVE-2022-0995的利用，展示了其对权限提升的影响。", "summary_en": "This article discusses the exploit of CVE-2022-0995, showcasing its implications for privilege escalation.", "source_markdown": "[2026: \"PageJack in Action: CVE-2022-0995 exploit\" by Jean Vincent](https://blog.quarkslab.com/pagejack-in-action-cve-2022-0995-exploit.html) [article] [CVE-2022-0995]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.quarkslab.com/pagejack-in-action-cve-2022-0995-exploit.html", "raw_path": "/raw/2026-vulnerabilities-lpe-pagejack-in-action-cve-2022-0995-exploit-primary-219b43b4.txt" } ] }, { "item_id": "0ff520435b1f5e92", "title": "Bonfee/CVE-2022-0995", "year": 2022, "authors": [], "primary_url": "https://github.com/Bonfee/CVE-2022-0995", "summary_zh": "CVE-2022-0995是一个可以被远程利用的Linux内核漏洞。", "summary_en": "CVE-2022-0995 is a Linux kernel vulnerability that can be exploited remotely.", "source_markdown": "https://github.com/Bonfee/CVE-2022-0995", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/Bonfee/CVE-2022-0995", "raw_path": "/raw/2022-exploits-bonfee-cve-2022-0995-primary-562bcefb.txt" } ] } ], "rank": 50 }, { "cve": "CVE-2022-1015", "year": 2022, "name": "A validation flaw in Netfilter leading to Local Privilege Escalation", "named_from_title": false, "name_source_title": "CVE-2022-1015: A validation flaw in Netfilter leading to Local Privilege Escalation", "discussion_count": 2, "resource_count": 2, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "a2b5a9939a937b9b", "title": "CVE-2022-1015: A validation flaw in Netfilter leading to Local Privilege Escalation", "year": 2022, "authors": [ "Yordan Stoychev" ], "primary_url": "https://anatomic.rip/cve-2022-1015/", "summary_zh": "CVE-2022-1015被分析为Netfilter中的验证缺陷，导致权限提升。", "summary_en": "CVE-2022-1015 is analyzed as a validation flaw in Netfilter leading to privilege escalation.", "source_markdown": "[2022: \"CVE-2022-1015: A validation flaw in Netfilter leading to Local Privilege Escalation\" by Yordan Stoychev](https://anatomic.rip/cve-2022-1015/) [article] [CVE-2022-1015]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://anatomic.rip/cve-2022-1015/", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-1015-a-validation-flaw-in-netfilter-leading-to-local-privilege-escalation-pr.txt" } ] }, { "item_id": "35498a870f86c341", "title": "How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables", "year": 2022, "authors": [ "David Bouman" ], "primary_url": "https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/", "summary_zh": "对nf_tables中两个新Linux漏洞的分析揭示了潜在的本地权限提升风险。", "summary_en": "An analysis of two new Linux vulnerabilities in nf_tables reveals potential local privilege escalation risks.", "source_markdown": "[2022: \"How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables\" by David Bouman](https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/) [CVE-2022-1015] [CVE-2022-1016]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/", "raw_path": "/raw/2022-vulnerabilities-lpe-how-the-tables-have-turned-an-analysis-of-two-new-linux-vulnerabilities-in-nf-tables-.txt" } ] } ], "rank": 51 }, { "cve": "CVE-2022-25636", "year": 2022, "name": "The Discovery and Exploitation of CVE-2022-25636", "named_from_title": false, "name_source_title": "The Discovery and Exploitation of CVE-2022-25636", "discussion_count": 2, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "85559d5919eb5e1c", "title": "Bonfee/CVE-2022-25636", "year": 2022, "authors": [], "primary_url": "https://github.com/Bonfee/CVE-2022-25636", "summary_zh": "CVE-2022-25636漏洞的利用代码。", "summary_en": "Exploit code for CVE-2022-25636 vulnerability.", "source_markdown": "https://github.com/Bonfee/CVE-2022-25636", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/Bonfee/CVE-2022-25636", "raw_path": "/raw/2022-exploits-bonfee-cve-2022-25636-primary-e998ef65.txt" } ] }, { "item_id": "835444cf0a9d86df", "title": "The Discovery and Exploitation of CVE-2022-25636", "year": 2022, "authors": [ "Nick Gregory" ], "primary_url": "https://nickgregory.me/linux/security/2022/03/12/cve-2022-25636/", "summary_zh": "CVE-2022-25636在Linux内核中存在本地权限提升漏洞。", "summary_en": "CVE-2022-25636 presents a local privilege escalation vulnerability in the Linux kernel.", "source_markdown": "[2022: \"The Discovery and Exploitation of CVE-2022-25636\" by Nick Gregory](https://nickgregory.me/linux/security/2022/03/12/cve-2022-25636/) [article] [CVE-2022-25636]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://nickgregory.me/linux/security/2022/03/12/cve-2022-25636/", "raw_path": "/raw/2022-vulnerabilities-lpe-the-discovery-and-exploitation-of-cve-2022-25636-primary-0cf33b45.txt" } ] } ], "rank": 52 }, { "cve": "CVE-2022-2602", "year": 2022, "name": "DirtyCred", "named_from_title": true, "name_source_title": "CVE-2022-2602: DirtyCred File Exploitation applied on an io_uring UAF", "discussion_count": 2, "resource_count": 2, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "2ed2173b030922cb", "title": "CVE-2022-2602: DirtyCred File Exploitation applied on an io_uring UAF", "year": 2022, "authors": [], "primary_url": "https://1day.dev/notes/CVE-2022-2602-DirtyCred-File-Exploitation-applied-on-an-io_uring-UAF/", "summary_zh": "CVE-2022-2602在使用后释放场景中的利用潜力被分析。", "summary_en": "CVE-2022-2602 is analyzed for its exploitation potential in a use-after-free scenario.", "source_markdown": "[2022: \"CVE-2022-2602: DirtyCred File Exploitation applied on an io_uring UAF\"](https://1day.dev/notes/CVE-2022-2602-DirtyCred-File-Exploitation-applied-on-an-io_uring-UAF/) [article] [CVE-2022-2602]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://1day.dev/notes/CVE-2022-2602-DirtyCred-File-Exploitation-applied-on-an-io_uring-UAF/", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-2602-dirtycred-file-exploitation-applied-on-an-io-uring-uaf-primary-09af3d90.txt" } ] }, { "item_id": "f68b29780c4762ca", "title": "DirtyCred Remastered: how to turn an UAF into Privilege Escalation", "year": 2022, "authors": [], "primary_url": "https://exploiter.dev/blog/2022/CVE-2022-2602.html", "summary_zh": "本文讨论了如何利用使用后释放漏洞进行权限提升。", "summary_en": "This article discusses how to exploit a use-after-free vulnerability for privilege escalation.", "source_markdown": "[2022: \"DirtyCred Remastered: how to turn an UAF into Privilege Escalation\"](https://exploiter.dev/blog/2022/CVE-2022-2602.html) [article] [CVE-2022-2602]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://exploiter.dev/blog/2022/CVE-2022-2602.html", "raw_path": "/raw/2022-vulnerabilities-lpe-dirtycred-remastered-how-to-turn-an-uaf-into-privilege-escalation-primary-9275273e.txt" } ] } ], "rank": 53 }, { "cve": "CVE-2022-27666", "year": 2022, "name": "Exploit esp6 modules in Linux kernel", "named_from_title": false, "name_source_title": "CVE-2022-27666: Exploit esp6 modules in Linux kernel", "discussion_count": 2, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023, 2022 ], "items": [ { "item_id": "32a16482ee2db35f", "title": "CVE-2022-27666: My file your memory", "year": 2023, "authors": [ "Erin Avllazagaj" ], "primary_url": "https://albocoder.github.io/exploit/2023/03/13/KernelFileExploit.html", "summary_zh": "分析Linux内核中的本地特权升级漏洞的文章。", "summary_en": "An article analyzing a local privilege escalation vulnerability in the Linux kernel.", "source_markdown": "[2023: \"CVE-2022-27666: My file your memory\" by Erin Avllazagaj](https://albocoder.github.io/exploit/2023/03/13/KernelFileExploit.html) [article] [CVE-2022-27666]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://albocoder.github.io/exploit/2023/03/13/KernelFileExploit.html", "raw_path": "/raw/2023-vulnerabilities-lpe-cve-2022-27666-my-file-your-memory-primary-7e9a3bd6.txt" } ] }, { "item_id": "7d044e75d9233e37", "title": "CVE-2022-27666: Exploit esp6 modules in Linux kernel", "year": 2022, "authors": [ "ETenal" ], "primary_url": "https://etenal.me/archives/1825", "summary_zh": "CVE-2022-27666利用Linux内核esp6模块中的漏洞。", "summary_en": "CVE-2022-27666 exploits vulnerabilities in esp6 modules of the Linux kernel.", "source_markdown": "[2022: \"CVE-2022-27666: Exploit esp6 modules in Linux kernel\" by ETenal](https://etenal.me/archives/1825) [article] [CVE-2022-27666]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://etenal.me/archives/1825", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-27666-exploit-esp6-modules-in-linux-kernel-primary-50794dd3.txt" } ] } ], "rank": 54 }, { "cve": "CVE-2022-4543", "year": 2022, "name": "EntryBleed", "named_from_title": true, "name_source_title": "EntryBleed: A Universal KASLR Bypass against KPTI on Linux", "discussion_count": 2, "resource_count": 2, "component_id": "architecture", "component_label": "CPU architecture / side channels", "component_detail": "architecture-specific path", "kernel_location": "arch/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023, 2022 ], "items": [ { "item_id": "57681e95419c40bd", "title": "EntryBleed: A Universal KASLR Bypass against KPTI on Linux", "year": 2023, "authors": [], "primary_url": "https://dl.acm.org/doi/pdf/10.1145/3623652.3623669", "summary_zh": "提出了一种针对Linux上KPTI的通用KASLR绕过技术。", "summary_en": "Presents a universal KASLR bypass technique against KPTI on Linux.", "source_markdown": "[2023: \"EntryBleed: A Universal KASLR Bypass against KPTI on Linux\"](https://dl.acm.org/doi/pdf/10.1145/3623652.3623669) [paper] [CVE-2022-4543]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "paper", "url": "https://dl.acm.org/doi/pdf/10.1145/3623652.3623669", "raw_path": "/raw/2023-vulnerabilities-info-leaks-entrybleed-a-universal-kaslr-bypass-against-kpti-on-linux-primary-0edcbda0.txt" } ] }, { "item_id": "ff338acf43541734", "title": "EntryBleed: Breaking KASLR under KPTI with Prefetch (CVE-2022-4543)", "year": 2022, "authors": [], "primary_url": "https://www.willsroot.io/2022/12/entrybleed.html", "summary_zh": "讨论了使用预取技术打破KPTI下的KASLR。", "summary_en": "Discusses breaking KASLR under KPTI using prefetch techniques.", "source_markdown": "[2022: \"EntryBleed: Breaking KASLR under KPTI with Prefetch (CVE-2022-4543)\"](https://www.willsroot.io/2022/12/entrybleed.html) [article] [CVE-2022-4543]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.willsroot.io/2022/12/entrybleed.html", "raw_path": "/raw/2022-vulnerabilities-info-leaks-entrybleed-breaking-kaslr-under-kpti-with-prefetch-cve-2022-4543-primary-58bcd.txt" } ] } ], "rank": 55 }, { "cve": "CVE-2021-20226", "year": 2021, "name": "a reference counting bug which leads to local privilege escalation in io_uring", "named_from_title": false, "name_source_title": "CVE-2021-20226 a reference counting bug which leads to local privilege escalation in io_uring", "discussion_count": 2, "resource_count": 2, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "744a6858a59593b8", "title": "CVE-2021-20226 a reference counting bug which leads to local privilege escalation in io_uring", "year": 2021, "authors": [], "primary_url": "https://flattsecurity.medium.com/cve-2021-20226-a-reference-counting-bug-which-leads-to-local-privilege-escalation-in-io-uring-e946bd69177a", "summary_zh": "该资源讨论了io_uring中的引用计数错误，导致本地权限提升。", "summary_en": "This resource discusses a reference counting bug in io_uring leading to local privilege escalation.", "source_markdown": "[2021: \"CVE-2021-20226 a reference counting bug which leads to local privilege escalation in io_uring\"](https://flattsecurity.medium.com/cve-2021-20226-a-reference-counting-bug-which-leads-to-local-privilege-escalation-in-io-uring-e946bd69177a) [article] [CVE-2021-20226]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://flattsecurity.medium.com/cve-2021-20226-a-reference-counting-bug-which-leads-to-local-privilege-escalation-in-io-uring-e946bd69177a", "raw_path": "/raw/2021-vulnerabilities-lpe-cve-2021-20226-a-reference-counting-bug-which-leads-to-local-privilege-escalation-in-.txt" } ] }, { "item_id": "0716602dc2afd3be", "title": "CVE-2021-20226: A Reference-Counting Bug in the Linux Kernel io_uring Subsystem", "year": 2021, "authors": [ "Lucas Leong" ], "primary_url": "https://www.zerodayinitiative.com/blog/2021/4/22/cve-2021-20226-a-reference-counting-bug-in-the-linux-kernel-iouring-subsystem", "summary_zh": "CVE-2021-20226是Linux内核io_uring子系统中的引用计数错误，导致本地权限提升。", "summary_en": "CVE-2021-20226 is a reference-counting bug in the Linux kernel io_uring subsystem leading to local privilege escalation.", "source_markdown": "[2021: \"CVE-2021-20226: A Reference-Counting Bug in the Linux Kernel io_uring Subsystem\" by Lucas Leong](https://www.zerodayinitiative.com/blog/2021/4/22/cve-2021-20226-a-reference-counting-bug-in-the-linux-kernel-iouring-subsystem) [article] [CVE-2021-20226]", "affected_area": "io_uring", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.zerodayinitiative.com/blog/2021/4/22/cve-2021-20226-a-reference-counting-bug-in-the-linux-kernel-iouring-subsystem", "raw_path": "/raw/2021-vulnerabilities-lpe-cve-2021-20226-a-reference-counting-bug-in-the-linux-kernel-io-uring-subsystem-primar.txt" } ] } ], "rank": 56 }, { "cve": "CVE-2021-41073", "year": 2021, "name": "io_uring - new code, new bugs, and a new exploit technique", "named_from_title": false, "name_source_title": "io_uring - new code, new bugs, and a new exploit technique", "discussion_count": 2, "resource_count": 2, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "fdb3e871e21cbb1c", "title": "io_uring - new code, new bugs, and a new exploit technique", "year": 2022, "authors": [ "Lam Jun Rong" ], "primary_url": "https://starlabs.sg/blog/2022/06/io_uring-new-code-new-bugs-and-a-new-exploit-technique/", "summary_zh": "本文讨论与io_uring相关的新漏洞和利用技术。", "summary_en": "This article discusses new bugs and exploit techniques related to io_uring.", "source_markdown": "[2022: \"io_uring - new code, new bugs, and a new exploit technique\" by Lam Jun Rong](https://starlabs.sg/blog/2022/06/io_uring-new-code-new-bugs-and-a-new-exploit-technique/) [article] [CVE-2021-41073]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://starlabs.sg/blog/2022/06/io_uring-new-code-new-bugs-and-a-new-exploit-technique/", "raw_path": "/raw/2022-vulnerabilities-lpe-io-uring-new-code-new-bugs-and-a-new-exploit-technique-primary-c6650ea6.txt" } ] }, { "item_id": "7a766668216b3653", "title": "Put an io_uring on it: Exploiting the Linux Kernel", "year": 2022, "authors": [ "Valentina Palmiotti" ], "primary_url": "https://www.graplsecurity.com/post/iou-ring-exploiting-the-linux-kernel", "summary_zh": "io_uring漏洞(CVE-2021-41073)允许在Linux内核中进行本地权限提升。", "summary_en": "The io_uring vulnerability (CVE-2021-41073) allows for local privilege escalation in the Linux kernel.", "source_markdown": "[2022: \"Put an io_uring on it: Exploiting the Linux Kernel\" by Valentina Palmiotti](https://www.graplsecurity.com/post/iou-ring-exploiting-the-linux-kernel) [article] [CVE-2021-41073]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.graplsecurity.com/post/iou-ring-exploiting-the-linux-kernel", "raw_path": "/raw/2022-vulnerabilities-lpe-put-an-io-uring-on-it-exploiting-the-linux-kernel-primary-cdb1c22a.txt" } ] } ], "rank": 57 }, { "cve": "CVE-2021-43267", "year": 2021, "name": "Exploiting CVE-2021-43267", "named_from_title": false, "name_source_title": "Exploiting CVE-2021-43267", "discussion_count": 2, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "3c70bdf3d06e8fb3", "title": "CVE-2021-43267: Remote Linux Kernel Heap Overflow | TIPC Module Allows Arbitrary Code Execution", "year": 2021, "authors": [ "Max Van Amerongen" ], "primary_url": "https://www.sentinelone.com/labs/tipc-remote-linux-kernel-heap-overflow-allows-arbitrary-code-execution/", "summary_zh": "分析了Linux内核TIPC模块中的远程堆溢出漏洞CVE-2021-43267。", "summary_en": "Analyzes a remote heap overflow vulnerability in the Linux kernel TIPC module, CVE-2021-43267.", "source_markdown": "[2021: \"CVE-2021-43267: Remote Linux Kernel Heap Overflow | TIPC Module Allows Arbitrary Code Execution\" by Max Van Amerongen](https://www.sentinelone.com/labs/tipc-remote-linux-kernel-heap-overflow-allows-arbitrary-code-execution/) [article] [CVE-2021-43267]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.sentinelone.com/labs/tipc-remote-linux-kernel-heap-overflow-allows-arbitrary-code-execution/", "raw_path": "/raw/2021-vulnerabilities-other-cve-2021-43267-remote-linux-kernel-heap-overflow-tipc-module-allows-arbitrary-code-.txt" } ] }, { "item_id": "225c649cdc8893e3", "title": "Exploiting CVE-2021-43267", "year": 2021, "authors": [ "Blasty" ], "primary_url": "https://haxx.in/posts/pwning-tipc/", "summary_zh": "该文章提供了对CVE-2021-43267的利用见解。", "summary_en": "The article provides insights into exploiting CVE-2021-43267.", "source_markdown": "[2021: \"Exploiting CVE-2021-43267\" by Blasty](https://haxx.in/posts/pwning-tipc/) [article] [CVE-2021-43267]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://haxx.in/posts/pwning-tipc/", "raw_path": "/raw/2021-vulnerabilities-lpe-exploiting-cve-2021-43267-primary-18648d28.txt" } ] } ], "rank": 58 }, { "cve": "CVE-2023-3269", "year": 2023, "name": "StackRot", "named_from_title": true, "name_source_title": "StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability", "discussion_count": 2, "resource_count": 2, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "VMA maple tree", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "high", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025, 2023 ], "items": [ { "item_id": "37f846caa4a6b886", "title": "Memory-related CVEs Exploited in kernelCTF", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/01/12/memory-related-cves-exploited-in-kernelctf.html", "summary_zh": "本文讨论了在kernelCTF中利用的与内存相关的CVE。", "summary_en": "This article discusses memory-related CVEs exploited in kernelCTF.", "source_markdown": "[2025: \"Memory-related CVEs Exploited in kernelCTF\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/01/12/memory-related-cves-exploited-in-kernelctf.html) [article] [CVE-2024-50066] [CVE-2023-3269]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/01/12/memory-related-cves-exploited-in-kernelctf.html", "raw_path": "/raw/2025-vulnerabilities-other-memory-related-cves-exploited-in-kernelctf-primary-af81547c.txt" } ] }, { "item_id": "fb9b48ea85e521cd", "title": "StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability", "year": 2023, "authors": [ "Ruihan Li" ], "primary_url": "https://github.com/lrh2000/StackRot", "summary_zh": "StackRot（CVE-2023-3269）是Linux内核中的一个本地权限提升漏洞。", "summary_en": "StackRot (CVE-2023-3269) is a local privilege escalation vulnerability in the Linux kernel.", "source_markdown": "[2023: \"StackRot (CVE-2023-3269): Linux kernel privilege escalation vulnerability\" by Ruihan Li](https://github.com/lrh2000/StackRot) [article] [CVE-2023-3269]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/lrh2000/StackRot", "raw_path": "/raw/2023-vulnerabilities-lpe-stackrot-cve-2023-3269-linux-kernel-privilege-escalation-vulnerability-primary-b433ac.txt" } ] } ], "rank": 59 }, { "cve": "CVE-2021-3490", "year": 2021, "name": "Exploiting CVE-2021-3490 for Container Escapes", "named_from_title": false, "name_source_title": "Exploiting CVE-2021-3490 for Container Escapes", "discussion_count": 2, "resource_count": 2, "component_id": "ebpf", "component_label": "eBPF / verifier", "component_detail": "eBPF/verifier", "kernel_location": "kernel/bpf/ + net/core/filter.c", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023, 2021 ], "items": [ { "item_id": "68b6b3cf6861ebc4", "title": "Exploiting CVE-2021-3490 for Container Escapes", "year": 2023, "authors": [ "Karsten Kyonig" ], "primary_url": "https://www.crowdstrike.com/blog/exploiting-cve-2021-3490-for-container-escapes/", "summary_zh": "本文探讨了CVE-2021-3490在容器逃逸场景中的利用。", "summary_en": "This article explores the exploitation of CVE-2021-3490 for container escape scenarios.", "source_markdown": "[2023: \"Exploiting CVE-2021-3490 for Container Escapes\" by Karsten Kyonig](https://www.crowdstrike.com/blog/exploiting-cve-2021-3490-for-container-escapes/) [article] [CVE-2021-3490]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.crowdstrike.com/blog/exploiting-cve-2021-3490-for-container-escapes/", "raw_path": "/raw/2023-vulnerabilities-lpe-exploiting-cve-2021-3490-for-container-escapes-primary-1a53330d.txt" } ] }, { "item_id": "ef92e867a3d83763", "title": "Kernel Pwning with eBPF: a Love Story", "year": 2021, "authors": [ "Valentina Palmiotti" ], "primary_url": "https://www.graplsecurity.com/post/kernel-pwning-with-ebpf-a-love-story", "summary_zh": "该文章探讨了使用eBPF的内核利用技术。", "summary_en": "The article explores kernel exploitation techniques using eBPF.", "source_markdown": "[2021: \"Kernel Pwning with eBPF: a Love Story\" by Valentina Palmiotti](https://www.graplsecurity.com/post/kernel-pwning-with-ebpf-a-love-story) [article] [CVE-2021-3490]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.graplsecurity.com/post/kernel-pwning-with-ebpf-a-love-story", "raw_path": "/raw/2021-vulnerabilities-lpe-kernel-pwning-with-ebpf-a-love-story-primary-1fa1160d.txt" } ] } ], "rank": 60 }, { "cve": "CVE-2024-50302", "year": 2024, "name": "Cellebrite zero-day exploit used to target phone of Serbian student activist", "named_from_title": false, "name_source_title": "Cellebrite zero-day exploit used to target phone of Serbian student activist", "discussion_count": 1, "resource_count": 8, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "USB subsystem", "kernel_location": "drivers/", "component_confidence": "high", "android_priority": "high", "android_reason": "与 Cellebrite 手机利用链材料关联，优先核对 Android 设备的 USB 驱动版本与厂商回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "bc2c679ba638896b", "title": "Cellebrite zero-day exploit used to target phone of Serbian student activist", "year": 2025, "authors": [], "primary_url": "https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/", "summary_zh": "本文讨论了针对塞尔维亚学生活动家手机的零日漏洞利用。", "summary_en": "This article discusses a zero-day exploit targeting a Serbian student activist's phone.", "source_markdown": "[2025: \"Cellebrite zero-day exploit used to target phone of Serbian student activist\"](https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/) [article] [CVE-2024-53104] [CVE-2024-53197] [CVE-2024-50302] [[note 1](https://infosec.exchange/@zhuowei@notnow.dev/114130367739741197)] [[note 2](https://infosec.exchange/@zhuowei@notnow.dev/114323100736073083)] [[note 3](https://infosec.exchange/@zhuowei@notnow.dev/114329166341368428)] [[note 4](https://infosec.exchange/@zhuowei@notnow.dev/114405047904139584)] [[note 5](https://infosec.exchange/@zhuowei@notnow.dev/114453583508015434)] [[note 6](https://infosec.exchange/@zhuowei@notnow.dev/114531934296778222)] [[note 7](https://infosec.exchange/@twiddles/114343055353217091)]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-primar.txt" }, { "label": "note 1", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114130367739741197", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-1.txt" }, { "label": "note 2", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114323100736073083", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-2.txt" }, { "label": "note 3", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114329166341368428", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-3.txt" }, { "label": "note 4", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114405047904139584", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-4.txt" }, { "label": "note 5", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114453583508015434", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-5.txt" }, { "label": "note 6", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114531934296778222", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-6.txt" }, { "label": "note 7", "type": "article", "url": "https://infosec.exchange/@twiddles/114343055353217091", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-7.txt" } ] } ], "rank": 61 }, { "cve": "CVE-2024-53197", "year": 2024, "name": "Cellebrite zero-day exploit used to target phone of Serbian student activist", "named_from_title": false, "name_source_title": "Cellebrite zero-day exploit used to target phone of Serbian student activist", "discussion_count": 1, "resource_count": 8, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "USB subsystem", "kernel_location": "drivers/", "component_confidence": "high", "android_priority": "high", "android_reason": "与 Cellebrite 手机利用链材料关联，优先核对 Android 设备的 USB 驱动版本与厂商回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "bc2c679ba638896b", "title": "Cellebrite zero-day exploit used to target phone of Serbian student activist", "year": 2025, "authors": [], "primary_url": "https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/", "summary_zh": "本文讨论了针对塞尔维亚学生活动家手机的零日漏洞利用。", "summary_en": "This article discusses a zero-day exploit targeting a Serbian student activist's phone.", "source_markdown": "[2025: \"Cellebrite zero-day exploit used to target phone of Serbian student activist\"](https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/) [article] [CVE-2024-53104] [CVE-2024-53197] [CVE-2024-50302] [[note 1](https://infosec.exchange/@zhuowei@notnow.dev/114130367739741197)] [[note 2](https://infosec.exchange/@zhuowei@notnow.dev/114323100736073083)] [[note 3](https://infosec.exchange/@zhuowei@notnow.dev/114329166341368428)] [[note 4](https://infosec.exchange/@zhuowei@notnow.dev/114405047904139584)] [[note 5](https://infosec.exchange/@zhuowei@notnow.dev/114453583508015434)] [[note 6](https://infosec.exchange/@zhuowei@notnow.dev/114531934296778222)] [[note 7](https://infosec.exchange/@twiddles/114343055353217091)]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-primar.txt" }, { "label": "note 1", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114130367739741197", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-1.txt" }, { "label": "note 2", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114323100736073083", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-2.txt" }, { "label": "note 3", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114329166341368428", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-3.txt" }, { "label": "note 4", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114405047904139584", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-4.txt" }, { "label": "note 5", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114453583508015434", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-5.txt" }, { "label": "note 6", "type": "article", "url": "https://infosec.exchange/@zhuowei@notnow.dev/114531934296778222", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-6.txt" }, { "label": "note 7", "type": "article", "url": "https://infosec.exchange/@twiddles/114343055353217091", "raw_path": "/raw/2025-vulnerabilities-other-cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist-note-7.txt" } ] } ], "rank": 62 }, { "cve": "CVE-2023-21255", "year": 2023, "name": "Android Binder Attack Matrix", "named_from_title": false, "name_source_title": "Android Binder Attack Matrix", "discussion_count": 1, "resource_count": 5, "component_id": "android-ipc", "component_label": "Android IPC / Binder", "component_detail": "Binder IPC", "kernel_location": "drivers/android/", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "6652bc32fe01330e", "title": "Android Binder Attack Matrix", "year": 2024, "authors": [ "Utkarsh" ], "primary_url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-introduction-450d31d1d951", "summary_zh": "一篇介绍Android Binder攻击矩阵及其漏洞的文章。", "summary_en": "An article introducing the Android Binder Attack Matrix and its vulnerabilities.", "source_markdown": "[2024: \"Android Binder Attack Matrix\" by Utkarsh](https://utkarshcodes.medium.com/android-binder-attack-matrix-introduction-450d31d1d951) [article]\n[[part 2](https://utkarshcodes.medium.com/android-binder-attack-matrix-cve-2023-20938-cve-2023-21255-uaf-details-article-1-4cc2eb3919f9)]\n[[part 3](https://utkarshcodes.medium.com/android-binder-attack-matrix-exploitation-of-cve-2023-20938-article-2-6215160e3373)]\n[[part 4](https://utkarshcodes.medium.com/android-binder-attack-matrix-fuzzing-binder-with-linux-kernel-library-lkl-article-3-62e931161eb5)]\n[[part 5](https://utkarshcodes.medium.com/android-binder-attack-matrix-results-conclusion-d7143057408f)]", "affected_area": "Binder", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-introduction-450d31d1d951", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-primary-c55362d7.txt" }, { "label": "part 2", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-cve-2023-20938-cve-2023-21255-uaf-details-article-1-4cc2eb3919f9", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-part-2-ba997b47.txt" }, { "label": "part 3", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-exploitation-of-cve-2023-20938-article-2-6215160e3373", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-part-3-67d5aaa8.txt" }, { "label": "part 4", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-fuzzing-binder-with-linux-kernel-library-lkl-article-3-62e931161eb5", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-part-4-a8e97e33.txt" }, { "label": "part 5", "type": "article", "url": "https://utkarshcodes.medium.com/android-binder-attack-matrix-results-conclusion-d7143057408f", "raw_path": "/raw/2024-vulnerabilities-lpe-android-binder-attack-matrix-part-5-d3dde1e1.txt" } ] } ], "rank": 63 }, { "cve": "CVE-2022-20421", "year": 2022, "name": "Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel", "named_from_title": false, "name_source_title": "Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel", "discussion_count": 1, "resource_count": 4, "component_id": "core-kernel", "component_label": "Core kernel / task lifetime", "component_detail": "Android kernel spinlock/lifetime path", "kernel_location": "kernel/ + fs/exec.c", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "bc1c4a289dcb48ca", "title": "Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel", "year": 2023, "authors": [ "Moshe Kol" ], "primary_url": "https://0xkol.github.io/assets/files/Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf", "summary_zh": "本文讨论了在Android内核中利用自旋锁使用后释放漏洞的攻击。", "summary_en": "The article discusses exploiting a spinlock use-after-free vulnerability in the Android kernel.", "source_markdown": "[2023: \"Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel\" by Moshe Kol](https://0xkol.github.io/assets/files/Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf) [article] [[slides](https://0xkol.github.io/assets/files/OffensiveCon23_Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf)] [[video](https://www.youtube.com/watch?v=E3CVDOlcHC4)] [[exploit](https://github.com/0xkol/badspin)] [CVE-2022-20421]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://0xkol.github.io/assets/files/Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf", "raw_path": "/raw/2023-vulnerabilities-lpe-racing-against-the-lock-exploiting-spinlock-uaf-in-the-android-kernel-primary-2fca2fa.txt" }, { "label": "slides", "type": "slides", "url": "https://0xkol.github.io/assets/files/OffensiveCon23_Racing_Against_the_Lock__Exploiting_Spinlock_UAF_in_the_Android_Kernel.pdf", "raw_path": "/raw/2023-vulnerabilities-lpe-racing-against-the-lock-exploiting-spinlock-uaf-in-the-android-kernel-slides-677cdce9.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=E3CVDOlcHC4", "raw_path": "/raw/2023-vulnerabilities-lpe-racing-against-the-lock-exploiting-spinlock-uaf-in-the-android-kernel-video-bddd45d0.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/0xkol/badspin", "raw_path": "/raw/2023-vulnerabilities-lpe-racing-against-the-lock-exploiting-spinlock-uaf-in-the-android-kernel-exploit-9ac798c.txt" } ] } ], "rank": 64 }, { "cve": "CVE-2020-12351", "year": 2020, "name": "BleedingTooth", "named_from_title": true, "name_source_title": "BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution", "discussion_count": 1, "resource_count": 4, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "18333216639fd824", "title": "BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution", "year": 2021, "authors": [ "Andy Nguyen" ], "primary_url": "https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup", "summary_zh": "BleedingTooth使Linux蓝牙面临零点击远程代码执行漏洞。", "summary_en": "BleedingTooth exposes Linux Bluetooth to zero-click remote code execution vulnerabilities.", "source_markdown": "[2021: \"BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution\" by Andy Nguyen](https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup): [BadChoice](https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq), [BadKarma](https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq), [BadVibes](https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649) [article] [CVE-2020-12352, CVE-2020-12351, CVE-2020-24490]", "affected_area": "Bluetooth", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-primary-2a5a9d74.txt" }, { "label": "BadChoice", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-badchoice-7cff16bb.txt" }, { "label": "BadKarma", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-badkarma-de3565ee.txt" }, { "label": "BadVibes", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-badvibes-59936a05.txt" } ] } ], "rank": 65 }, { "cve": "CVE-2020-12352", "year": 2020, "name": "BleedingTooth", "named_from_title": true, "name_source_title": "BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution", "discussion_count": 1, "resource_count": 4, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "18333216639fd824", "title": "BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution", "year": 2021, "authors": [ "Andy Nguyen" ], "primary_url": "https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup", "summary_zh": "BleedingTooth使Linux蓝牙面临零点击远程代码执行漏洞。", "summary_en": "BleedingTooth exposes Linux Bluetooth to zero-click remote code execution vulnerabilities.", "source_markdown": "[2021: \"BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution\" by Andy Nguyen](https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup): [BadChoice](https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq), [BadKarma](https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq), [BadVibes](https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649) [article] [CVE-2020-12352, CVE-2020-12351, CVE-2020-24490]", "affected_area": "Bluetooth", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-primary-2a5a9d74.txt" }, { "label": "BadChoice", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-badchoice-7cff16bb.txt" }, { "label": "BadKarma", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-badkarma-de3565ee.txt" }, { "label": "BadVibes", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-badvibes-59936a05.txt" } ] } ], "rank": 66 }, { "cve": "CVE-2020-24490", "year": 2020, "name": "BleedingTooth", "named_from_title": true, "name_source_title": "BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution", "discussion_count": 1, "resource_count": 4, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "18333216639fd824", "title": "BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution", "year": 2021, "authors": [ "Andy Nguyen" ], "primary_url": "https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup", "summary_zh": "BleedingTooth使Linux蓝牙面临零点击远程代码执行漏洞。", "summary_en": "BleedingTooth exposes Linux Bluetooth to zero-click remote code execution vulnerabilities.", "source_markdown": "[2021: \"BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution\" by Andy Nguyen](https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup): [BadChoice](https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq), [BadKarma](https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq), [BadVibes](https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649) [article] [CVE-2020-12352, CVE-2020-12351, CVE-2020-24490]", "affected_area": "Bluetooth", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-primary-2a5a9d74.txt" }, { "label": "BadChoice", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-7mh3-gq28-gfrq", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-badchoice-7cff16bb.txt" }, { "label": "BadKarma", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-badkarma-de3565ee.txt" }, { "label": "BadVibes", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-ccx2-w2r4-x649", "raw_path": "/raw/2021-vulnerabilities-rce-bleedingtooth-linux-bluetooth-zero-click-remote-code-execution-badvibes-59936a05.txt" } ] } ], "rank": 67 }, { "cve": "CVE-2021-0399", "year": 2021, "name": "The Art of Exploiting UAF", "named_from_title": false, "name_source_title": "The Art of Exploiting UAF", "discussion_count": 1, "resource_count": 3, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "0c4b9182e54cf9b1", "title": "The Art of Exploiting UAF", "year": 2021, "authors": [ "Ret2bpf in Android Kernel\" by Xingyu Jin", "Richard Neal" ], "primary_url": "https://i.blackhat.com/EU-21/Wednesday/EU-21-Jin-The-Art-of-Exploiting-UAF-by-Ret2bpf-in-Android-Kernel-wp.pdf", "summary_zh": "该资源详细介绍了在Android内核中利用UAF漏洞的方式。", "summary_en": "This resource details the exploitation of UAF vulnerabilities in the Android kernel.", "source_markdown": "[2021: \"The Art of Exploiting UAF by Ret2bpf in Android Kernel\" by Xingyu Jin and Richard Neal](https://i.blackhat.com/EU-21/Wednesday/EU-21-Jin-The-Art-of-Exploiting-UAF-by-Ret2bpf-in-Android-Kernel-wp.pdf) [article] [[slides](https://conference.hitb.org/hitbsecconf2021sin/materials/D1T1%20-%20%20The%20Art%20of%20Exploiting%20UAF%20by%20Ret2bpf%20in%20Android%20Kernel%20-%20Xingyu%20Jin%20&%20Richard%20Neal.pdf)] [[video](https://www.youtube.com/watch?v=7UXtirV1Vzg)] [CVE-2021-0399]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://i.blackhat.com/EU-21/Wednesday/EU-21-Jin-The-Art-of-Exploiting-UAF-by-Ret2bpf-in-Android-Kernel-wp.pdf", "raw_path": "/raw/2021-vulnerabilities-lpe-the-art-of-exploiting-uaf-primary-6b950310.txt" }, { "label": "slides", "type": "slides", "url": "https://conference.hitb.org/hitbsecconf2021sin/materials/D1T1%20-%20%20The%20Art%20of%20Exploiting%20UAF%20by%20Ret2bpf%20in%20Android%20Kernel%20-%20Xingyu%20Jin%20&%20Richard%20Neal.pdf", "raw_path": "/raw/2021-vulnerabilities-lpe-the-art-of-exploiting-uaf-slides-94588e83.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=7UXtirV1Vzg", "raw_path": "/raw/2021-vulnerabilities-lpe-the-art-of-exploiting-uaf-video-e6473586.txt" } ] } ], "rank": 68 }, { "cve": "CVE-2023-0179", "year": 2023, "name": "64 bytes and a ROP chain – A journey through nftables", "named_from_title": false, "name_source_title": "64 bytes and a ROP chain – A journey through nftables", "discussion_count": 1, "resource_count": 3, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "d24d45f6d05b1334", "title": "64 bytes and a ROP chain – A journey through nftables", "year": 2024, "authors": [ "Davide Ornaghi" ], "primary_url": "https://betrusted.it/blog/64-bytes-and-a-rop-chain-part-1/", "summary_zh": "2024 年 Linux 内核LPE资料：「64 bytes and a ROP chain – A journey through nftables」（CVE-2023-0179）；URL 类型：article。", "summary_en": "2024 Linux kernel LPE resource \"64 bytes and a ROP chain – A journey through nftables\" (CVE-2023-0179); URL type: article.", "source_markdown": "[2024: \"64 bytes and a ROP chain – A journey through nftables\" by Davide Ornaghi](https://betrusted.it/blog/64-bytes-and-a-rop-chain-part-1/) [article] [[part 2](https://betrusted.it/blog/64-bytes-and-a-rop-chain-part-2/)] [[exploit](https://github.com/TurtleARM/CVE-2023-0179-PoC)] [CVE-2023-0179]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://betrusted.it/blog/64-bytes-and-a-rop-chain-part-1/", "raw_path": "/raw/2024-vulnerabilities-lpe-64-bytes-and-a-rop-chain-a-journey-through-nftables-primary-7f0a94d3.txt" }, { "label": "part 2", "type": "article", "url": "https://betrusted.it/blog/64-bytes-and-a-rop-chain-part-2/", "raw_path": "/raw/2024-vulnerabilities-lpe-64-bytes-and-a-rop-chain-a-journey-through-nftables-part-2-ddd71752.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/TurtleARM/CVE-2023-0179-PoC", "raw_path": "/raw/2024-vulnerabilities-lpe-64-bytes-and-a-rop-chain-a-journey-through-nftables-exploit-194a7fbd.txt" } ] } ], "rank": 69 }, { "cve": "CVE-2024-20018", "year": 2024, "name": "Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap", "named_from_title": false, "name_source_title": "Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap", "discussion_count": 1, "resource_count": 3, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "e2ede9f6c1df2588", "title": "Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap", "year": 2024, "authors": [ "Robert Herrera", "Alex Plaskett" ], "primary_url": "https://www.nccgroup.com/media/uzbp3ttw/bhus24_sonos_whitepaper.pdf", "summary_zh": "Listen Up详细介绍了远程内核利用和隐秘窃听漏洞。", "summary_en": "Listen Up details remote kernel exploitation and covert wiretap vulnerabilities.", "source_markdown": "[2024: \"Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap\" by Robert Herrera and Alex Plaskett](https://www.nccgroup.com/media/uzbp3ttw/bhus24_sonos_whitepaper.pdf) [article] [[slides](https://i.blackhat.com/BH-US-24/Presentations/US-24-Herrera-Listen-Up-Sonos-Over-The-Air-Exploitation-and-Covert-Wiretap-Thursday.pdf)] [[video](https://www.youtube.com/watch?v=piw0CZ46-Q0)] [CVE-2023-50809] [CVE-2024-20018]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.nccgroup.com/media/uzbp3ttw/bhus24_sonos_whitepaper.pdf", "raw_path": "/raw/2024-vulnerabilities-rce-listen-up-sonos-over-the-air-remote-kernel-exploitation-and-covert-wiretap-primary-e5.txt" }, { "label": "slides", "type": "slides", "url": "https://i.blackhat.com/BH-US-24/Presentations/US-24-Herrera-Listen-Up-Sonos-Over-The-Air-Exploitation-and-Covert-Wiretap-Thursday.pdf", "raw_path": "/raw/2024-vulnerabilities-rce-listen-up-sonos-over-the-air-remote-kernel-exploitation-and-covert-wiretap-slides-27c.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=piw0CZ46-Q0", "raw_path": "/raw/2024-vulnerabilities-rce-listen-up-sonos-over-the-air-remote-kernel-exploitation-and-covert-wiretap-video-c251.txt" } ] } ], "rank": 70 }, { "cve": "CVE-2023-50809", "year": 2023, "name": "Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap", "named_from_title": false, "name_source_title": "Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap", "discussion_count": 1, "resource_count": 3, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "e2ede9f6c1df2588", "title": "Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap", "year": 2024, "authors": [ "Robert Herrera", "Alex Plaskett" ], "primary_url": "https://www.nccgroup.com/media/uzbp3ttw/bhus24_sonos_whitepaper.pdf", "summary_zh": "Listen Up详细介绍了远程内核利用和隐秘窃听漏洞。", "summary_en": "Listen Up details remote kernel exploitation and covert wiretap vulnerabilities.", "source_markdown": "[2024: \"Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap\" by Robert Herrera and Alex Plaskett](https://www.nccgroup.com/media/uzbp3ttw/bhus24_sonos_whitepaper.pdf) [article] [[slides](https://i.blackhat.com/BH-US-24/Presentations/US-24-Herrera-Listen-Up-Sonos-Over-The-Air-Exploitation-and-Covert-Wiretap-Thursday.pdf)] [[video](https://www.youtube.com/watch?v=piw0CZ46-Q0)] [CVE-2023-50809] [CVE-2024-20018]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.nccgroup.com/media/uzbp3ttw/bhus24_sonos_whitepaper.pdf", "raw_path": "/raw/2024-vulnerabilities-rce-listen-up-sonos-over-the-air-remote-kernel-exploitation-and-covert-wiretap-primary-e5.txt" }, { "label": "slides", "type": "slides", "url": "https://i.blackhat.com/BH-US-24/Presentations/US-24-Herrera-Listen-Up-Sonos-Over-The-Air-Exploitation-and-Covert-Wiretap-Thursday.pdf", "raw_path": "/raw/2024-vulnerabilities-rce-listen-up-sonos-over-the-air-remote-kernel-exploitation-and-covert-wiretap-slides-27c.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=piw0CZ46-Q0", "raw_path": "/raw/2024-vulnerabilities-rce-listen-up-sonos-over-the-air-remote-kernel-exploitation-and-covert-wiretap-video-c251.txt" } ] } ], "rank": 71 }, { "cve": "CVE-2023-32832", "year": 2023, "name": "Driving forward in Android drivers", "named_from_title": false, "name_source_title": "Driving forward in Android drivers", "discussion_count": 1, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "7eb57e1d9e3d11d1", "title": "Driving forward in Android drivers", "year": 2024, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html", "summary_zh": "本文探讨了Android驱动程序中的漏洞及其潜在影响。", "summary_en": "This article explores vulnerabilities in Android drivers and their potential impacts.", "source_markdown": "[2024: \"Driving forward in Android drivers\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html) [article] [[video](https://archive.org/details/shmoocon2024/Shmoocon2024-SethJenkins-Driving_Forward_in_Android_Drivers.mp4)] [CVE-2023-32837] [CVE-2023-32832]", "affected_area": "Drivers", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html", "raw_path": "/raw/2024-vulnerabilities-lpe-driving-forward-in-android-drivers-primary-98f06ef4.txt" }, { "label": "video", "type": "video", "url": "https://archive.org/details/shmoocon2024/Shmoocon2024-SethJenkins-Driving_Forward_in_Android_Drivers.mp4", "raw_path": "/raw/2024-vulnerabilities-lpe-driving-forward-in-android-drivers-video-fa932318.txt" } ] } ], "rank": 72 }, { "cve": "CVE-2023-32837", "year": 2023, "name": "Driving forward in Android drivers", "named_from_title": false, "name_source_title": "Driving forward in Android drivers", "discussion_count": 1, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "7eb57e1d9e3d11d1", "title": "Driving forward in Android drivers", "year": 2024, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html", "summary_zh": "本文探讨了Android驱动程序中的漏洞及其潜在影响。", "summary_en": "This article explores vulnerabilities in Android drivers and their potential impacts.", "source_markdown": "[2024: \"Driving forward in Android drivers\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html) [article] [[video](https://archive.org/details/shmoocon2024/Shmoocon2024-SethJenkins-Driving_Forward_in_Android_Drivers.mp4)] [CVE-2023-32837] [CVE-2023-32832]", "affected_area": "Drivers", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2024/06/driving-forward-in-android-drivers.html", "raw_path": "/raw/2024-vulnerabilities-lpe-driving-forward-in-android-drivers-primary-98f06ef4.txt" }, { "label": "video", "type": "video", "url": "https://archive.org/details/shmoocon2024/Shmoocon2024-SethJenkins-Driving_Forward_in_Android_Drivers.mp4", "raw_path": "/raw/2024-vulnerabilities-lpe-driving-forward-in-android-drivers-video-fa932318.txt" } ] } ], "rank": 73 }, { "cve": "CVE-2022-20409", "year": 2022, "name": "Bad io_uring", "named_from_title": true, "name_source_title": "Bad io_uring: A New Era of Rooting for Android", "discussion_count": 1, "resource_count": 2, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "Android io_uring path", "kernel_location": "io_uring/", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "f05f12395ecd5870", "title": "Bad io_uring: A New Era of Rooting for Android", "year": 2023, "authors": [ "Zhenpeng Lin" ], "primary_url": "https://i.blackhat.com/BH-US-23/Presentations/US-23-Lin-bad_io_uring.pdf", "summary_zh": "本演示涵盖了利用io_uring在Android中进行本地权限提升的漏洞。", "summary_en": "This presentation covers a local privilege escalation vulnerability in Android using io_uring.", "source_markdown": "[2023: \"Bad io_uring: A New Era of Rooting for Android\" by Zhenpeng Lin](https://i.blackhat.com/BH-US-23/Presentations/US-23-Lin-bad_io_uring.pdf) [slides] [[video](https://www.youtube.com/watch?v=fhx3W1z7YD0)] [CVE-2022-20409]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/BH-US-23/Presentations/US-23-Lin-bad_io_uring.pdf", "raw_path": "/raw/2023-vulnerabilities-lpe-bad-io-uring-a-new-era-of-rooting-for-android-primary-e4328c54.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=fhx3W1z7YD0", "raw_path": "/raw/2023-vulnerabilities-lpe-bad-io-uring-a-new-era-of-rooting-for-android-video-2bff7cd2.txt" } ] } ], "rank": 74 }, { "cve": "CVE-2021-1961", "year": 2021, "name": "Attacking the Android kernel using the Qualcomm TrustZone", "named_from_title": false, "name_source_title": "Attacking the Android kernel using the Qualcomm TrustZone", "discussion_count": 1, "resource_count": 2, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm TrustZone-facing driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "ca73012cc5ecf6db", "title": "Attacking the Android kernel using the Qualcomm TrustZone", "year": 2022, "authors": [ "Tamir Zahavi-Brunner" ], "primary_url": "https://tamirzb.com/attacking-android-kernel-using-qualcomm-trustzone", "summary_zh": "本文讨论了通过高通TrustZone漏洞攻击Android内核。", "summary_en": "The article discusses exploiting the Android kernel via Qualcomm TrustZone vulnerabilities.", "source_markdown": "[2022: \"Attacking the Android kernel using the Qualcomm TrustZone\" by Tamir Zahavi-Brunner](https://tamirzb.com/attacking-android-kernel-using-qualcomm-trustzone) [article] [[video](https://www.youtube.com/watch?v=WXqff23dT5I)] [CVE-2021-1961]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://tamirzb.com/attacking-android-kernel-using-qualcomm-trustzone", "raw_path": "/raw/2022-vulnerabilities-lpe-attacking-the-android-kernel-using-the-qualcomm-trustzone-primary-3ada8d65.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=WXqff23dT5I", "raw_path": "/raw/2022-vulnerabilities-lpe-attacking-the-android-kernel-using-the-qualcomm-trustzone-video-19c0a27a.txt" } ] } ], "rank": 75 }, { "cve": "CVE-2024-21455", "year": 2024, "name": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "named_from_title": false, "name_source_title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "discussion_count": 1, "resource_count": 2, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm DSP driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "018b1830d74b2f9d", "title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "year": 2024, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "summary_zh": "2024 年 Linux 内核LPE资料：「The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit」（CVE-2024-38402、CVE-2024-21455、CVE-2024-33060、CVE-2024-49848、CVE-2024-43047）；URL 类型：article。 Android 影响：possible。", "summary_en": "2024 Linux kernel LPE resource \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" (CVE-2024-38402, CVE-2024-21455, CVE-2024-33060, CVE-2024-49848, CVE-2024-43047); URL type: article. Android impact: possible.", "source_markdown": "[2024: \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html) [article] [video](https://www.youtube.com/watch?v=lnK1iACJ3-c) [CVE-2024-38402] [CVE-2024-21455] [CVE-2024-33060] [CVE-2024-49848] [CVE-2024-43047]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-primary-af034bfc.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=lnK1iACJ3-c", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-video-c46f839a.txt" } ] } ], "rank": 76 }, { "cve": "CVE-2024-33060", "year": 2024, "name": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "named_from_title": false, "name_source_title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "discussion_count": 1, "resource_count": 2, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm DSP driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "018b1830d74b2f9d", "title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "year": 2024, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "summary_zh": "2024 年 Linux 内核LPE资料：「The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit」（CVE-2024-38402、CVE-2024-21455、CVE-2024-33060、CVE-2024-49848、CVE-2024-43047）；URL 类型：article。 Android 影响：possible。", "summary_en": "2024 Linux kernel LPE resource \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" (CVE-2024-38402, CVE-2024-21455, CVE-2024-33060, CVE-2024-49848, CVE-2024-43047); URL type: article. Android impact: possible.", "source_markdown": "[2024: \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html) [article] [video](https://www.youtube.com/watch?v=lnK1iACJ3-c) [CVE-2024-38402] [CVE-2024-21455] [CVE-2024-33060] [CVE-2024-49848] [CVE-2024-43047]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-primary-af034bfc.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=lnK1iACJ3-c", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-video-c46f839a.txt" } ] } ], "rank": 77 }, { "cve": "CVE-2024-38402", "year": 2024, "name": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "named_from_title": false, "name_source_title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "discussion_count": 1, "resource_count": 2, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm DSP driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "018b1830d74b2f9d", "title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "year": 2024, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "summary_zh": "2024 年 Linux 内核LPE资料：「The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit」（CVE-2024-38402、CVE-2024-21455、CVE-2024-33060、CVE-2024-49848、CVE-2024-43047）；URL 类型：article。 Android 影响：possible。", "summary_en": "2024 Linux kernel LPE resource \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" (CVE-2024-38402, CVE-2024-21455, CVE-2024-33060, CVE-2024-49848, CVE-2024-43047); URL type: article. Android impact: possible.", "source_markdown": "[2024: \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html) [article] [video](https://www.youtube.com/watch?v=lnK1iACJ3-c) [CVE-2024-38402] [CVE-2024-21455] [CVE-2024-33060] [CVE-2024-49848] [CVE-2024-43047]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-primary-af034bfc.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=lnK1iACJ3-c", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-video-c46f839a.txt" } ] } ], "rank": 78 }, { "cve": "CVE-2024-43047", "year": 2024, "name": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "named_from_title": false, "name_source_title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "discussion_count": 1, "resource_count": 2, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm DSP driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "018b1830d74b2f9d", "title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "year": 2024, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "summary_zh": "2024 年 Linux 内核LPE资料：「The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit」（CVE-2024-38402、CVE-2024-21455、CVE-2024-33060、CVE-2024-49848、CVE-2024-43047）；URL 类型：article。 Android 影响：possible。", "summary_en": "2024 Linux kernel LPE resource \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" (CVE-2024-38402, CVE-2024-21455, CVE-2024-33060, CVE-2024-49848, CVE-2024-43047); URL type: article. Android impact: possible.", "source_markdown": "[2024: \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html) [article] [video](https://www.youtube.com/watch?v=lnK1iACJ3-c) [CVE-2024-38402] [CVE-2024-21455] [CVE-2024-33060] [CVE-2024-49848] [CVE-2024-43047]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-primary-af034bfc.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=lnK1iACJ3-c", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-video-c46f839a.txt" } ] } ], "rank": 79 }, { "cve": "CVE-2024-49848", "year": 2024, "name": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "named_from_title": false, "name_source_title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "discussion_count": 1, "resource_count": 2, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm DSP driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "018b1830d74b2f9d", "title": "The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit", "year": 2024, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "summary_zh": "2024 年 Linux 内核LPE资料：「The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit」（CVE-2024-38402、CVE-2024-21455、CVE-2024-33060、CVE-2024-49848、CVE-2024-43047）；URL 类型：article。 Android 影响：possible。", "summary_en": "2024 Linux kernel LPE resource \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" (CVE-2024-38402, CVE-2024-21455, CVE-2024-33060, CVE-2024-49848, CVE-2024-43047); URL type: article. Android impact: possible.", "source_markdown": "[2024: \"The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html) [article] [video](https://www.youtube.com/watch?v=lnK1iACJ3-c) [CVE-2024-38402] [CVE-2024-21455] [CVE-2024-33060] [CVE-2024-49848] [CVE-2024-43047]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-primary-af034bfc.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=lnK1iACJ3-c", "raw_path": "/raw/2024-vulnerabilities-lpe-the-qualcomm-dsp-driver-unexpectedly-excavating-an-exploit-video-c46f839a.txt" } ] } ], "rank": 80 }, { "cve": "CVE-2026-46300", "year": 2026, "name": "Fragnesia", "named_from_title": true, "name_source_title": "Fragnesia", "discussion_count": 1, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "03cf420e60c444e4", "title": "Fragnesia", "year": 2026, "authors": [ "William Bowling" ], "primary_url": "https://github.com/v12-security/pocs/tree/main/fragnesia", "summary_zh": "Fragnesia 是一个影响本地权限提升的 Linux 内核漏洞。", "summary_en": "Fragnesia is a Linux kernel vulnerability affecting local privilege escalation.", "source_markdown": "[2026: \"Fragnesia\" by William Bowling](https://github.com/v12-security/pocs/tree/main/fragnesia) [article] [[variant](https://github.com/v12-security/pocs/tree/main/fragnesia-5db89c99566fc)] [CVE-2026-46300] [Fragnesia]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/v12-security/pocs/tree/main/fragnesia", "raw_path": "/raw/2026-vulnerabilities-lpe-fragnesia-primary-ece4279c.txt" }, { "label": "variant", "type": "artifact", "url": "https://github.com/v12-security/pocs/tree/main/fragnesia-5db89c99566fc", "raw_path": "/raw/2026-vulnerabilities-lpe-fragnesia-variant-9363901a.txt" } ] } ], "rank": 81 }, { "cve": "CVE-2025-0927", "year": 2025, "name": "Linux kernel hfsplus slab-out-of-bounds Write", "named_from_title": false, "name_source_title": "Linux kernel hfsplus slab-out-of-bounds Write", "discussion_count": 1, "resource_count": 2, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem, VFS, or storage", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "418f409a6532464c", "title": "Linux kernel hfsplus slab-out-of-bounds Write", "year": 2025, "authors": [ "Attila Szasz" ], "primary_url": "https://ssd-disclosure.com/ssd-advisory-linux-kernel-hfsplus-slab-out-of-bounds-write/", "summary_zh": "2025 年 Linux 内核LPE资料：「Linux kernel hfsplus slab-out-of-bounds Write」（CVE-2025-0927）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"Linux kernel hfsplus slab-out-of-bounds Write\" (CVE-2025-0927); URL type: article.", "source_markdown": "[2025: \"Linux kernel hfsplus slab-out-of-bounds Write\" by Attila Szasz](https://ssd-disclosure.com/ssd-advisory-linux-kernel-hfsplus-slab-out-of-bounds-write/) [article] [slides](https://drive.google.com/file/d/1Z_0jgLpGmcC3VO-jGxR-vwAAc9F9Ovcu/view) [CVE-2025-0927]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://ssd-disclosure.com/ssd-advisory-linux-kernel-hfsplus-slab-out-of-bounds-write/", "raw_path": "/raw/2025-vulnerabilities-lpe-linux-kernel-hfsplus-slab-out-of-bounds-write-primary-de6469ae.txt" }, { "label": "slides", "type": "slides", "url": "https://drive.google.com/file/d/1Z_0jgLpGmcC3VO-jGxR-vwAAc9F9Ovcu/view", "raw_path": "/raw/2025-vulnerabilities-lpe-linux-kernel-hfsplus-slab-out-of-bounds-write-slides-96907801.txt" } ] } ], "rank": 82 }, { "cve": "CVE-2025-21692", "year": 2025, "name": "nday writeup", "named_from_title": false, "name_source_title": "CVE-2025-21692 nday writeup", "discussion_count": 1, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "800d77ff206f13d0", "title": "CVE-2025-21692 nday writeup", "year": 2025, "authors": [ "volticks" ], "primary_url": "https://volticks.github.io/CVE-2025-21692-nday-writeup/", "summary_zh": "2025 年 Linux 内核LPE资料：「CVE-2025-21692 nday writeup」（CVE-2025-21692、CVE-2025-21756）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"CVE-2025-21692 nday writeup\" (CVE-2025-21692, CVE-2025-21756); URL type: article.", "source_markdown": "[2025: \"CVE-2025-21692 nday writeup\" by volticks](https://volticks.github.io/CVE-2025-21692-nday-writeup/) [article] [[exploit](https://github.com/volticks/CVE-2025-21692-poc)] [CVE-2025-21756]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://volticks.github.io/CVE-2025-21692-nday-writeup/", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-21692-nday-writeup-primary-0ad97bd0.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/volticks/CVE-2025-21692-poc", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-21692-nday-writeup-exploit-e127e319.txt" } ] } ], "rank": 83 }, { "cve": "CVE-2025-21836", "year": 2025, "name": "Déjà Vu in Linux io_uring: Breaking Memory Sharing Again After Generations of Fixes", "named_from_title": false, "name_source_title": "Déjà Vu in Linux io_uring: Breaking Memory Sharing Again After Generations of Fixes", "discussion_count": 1, "resource_count": 2, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "8cb3202f36b2333f", "title": "Déjà Vu in Linux io_uring: Breaking Memory Sharing Again After Generations of Fixes", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/slides/talks/2025_Hexacon-Deja_Vu_in_Linux_io_uring_Breaking_Memory_Sharing_Again_After_Generations_of_Fixes.pdf", "summary_zh": "Linux io_uring中的Déjà Vu讨论了导致本地特权提升的内存共享漏洞。", "summary_en": "Déjà Vu in Linux io_uring discusses breaking memory sharing vulnerabilities leading to local privilege escalation.", "source_markdown": "[2025: \"Déjà Vu in Linux io_uring: Breaking Memory Sharing Again After Generations of Fixes\" by Pumpkin Chang](https://u1f383.github.io/slides/talks/2025_Hexacon-Deja_Vu_in_Linux_io_uring_Breaking_Memory_Sharing_Again_After_Generations_of_Fixes.pdf) [slides] [[video](https://www.youtube.com/watch?v=Ry4eOgLCo90)] [CVE-2025-21836]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://u1f383.github.io/slides/talks/2025_Hexacon-Deja_Vu_in_Linux_io_uring_Breaking_Memory_Sharing_Again_After_Generations_of_Fixes.pdf", "raw_path": "/raw/2025-vulnerabilities-lpe-d-j-vu-in-linux-io-uring-breaking-memory-sharing-again-after-generations-of-fixes-pri.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=Ry4eOgLCo90", "raw_path": "/raw/2025-vulnerabilities-lpe-d-j-vu-in-linux-io-uring-breaking-memory-sharing-again-after-generations-of-fixes-vid.txt" } ] } ], "rank": 84 }, { "cve": "CVE-2025-37899", "year": 2025, "name": "How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation", "named_from_title": false, "name_source_title": "How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation", "discussion_count": 1, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "26f104bffe29b4fa", "title": "How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation", "year": 2025, "authors": [ "Sean Heelan" ], "primary_url": "https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/", "summary_zh": "本文描述了如何发现Linux内核SMB实现中的远程零日漏洞。", "summary_en": "This article describes finding a remote zeroday vulnerability in the Linux kernel's SMB implementation.", "source_markdown": "[2025: \"How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation\" by Sean Heelan](https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/) [article] [[note](https://x.com/antirez/status/1926580457048588321)]", "affected_area": "SMB", "android_status": "no", "android_confirmed": false, "android_reason": "Not enough evidence that this resource maps to released Android devices.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://sean.heelan.io/2025/05/22/how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernels-smb-implementation/", "raw_path": "/raw/2025-finding-bugs-how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernel-s-sm.txt" }, { "label": "note", "type": "article", "url": "https://x.com/antirez/status/1926580457048588321", "raw_path": "/raw/2025-finding-bugs-how-i-used-o3-to-find-cve-2025-37899-a-remote-zeroday-vulnerability-in-the-linux-kernel-s-sm-2.txt" } ] } ], "rank": 85 }, { "cve": "CVE-2025-39965", "year": 2025, "name": "Dissecting a 1-Day Vulnerability in Linux's XFRM Subsystem", "named_from_title": false, "name_source_title": "Dissecting a 1-Day Vulnerability in Linux's XFRM Subsystem", "discussion_count": 1, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "1845bf540e733aa1", "title": "Dissecting a 1-Day Vulnerability in Linux's XFRM Subsystem", "year": 2025, "authors": [ "Shreyas Penkar" ], "primary_url": "https://streypaws.github.io/posts/Dissecting-a-1-Day-Vulnerability-in-Linux-XFRM-Subsystem/", "summary_zh": "CVE-2025-39965是Linux的XFRM子系统中的一天漏洞。", "summary_en": "CVE-2025-39965 is a one-day vulnerability in Linux's XFRM subsystem.", "source_markdown": "[2025: \"Dissecting a 1-Day Vulnerability in Linux's XFRM Subsystem\" by Shreyas Penkar](https://streypaws.github.io/posts/Dissecting-a-1-Day-Vulnerability-in-Linux-XFRM-Subsystem/) [article] [CVE-2025-39965] [[trigger](https://github.com/Shreyas-Penkar/CVE-2025-39965)]", "affected_area": "XFRM", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://streypaws.github.io/posts/Dissecting-a-1-Day-Vulnerability-in-Linux-XFRM-Subsystem/", "raw_path": "/raw/2025-vulnerabilities-other-dissecting-a-1-day-vulnerability-in-linux-s-xfrm-subsystem-primary-1077cdfe.txt" }, { "label": "trigger", "type": "code", "url": "https://github.com/Shreyas-Penkar/CVE-2025-39965", "raw_path": "/raw/2025-vulnerabilities-other-dissecting-a-1-day-vulnerability-in-linux-s-xfrm-subsystem-trigger-0d2e2bfb.txt" } ] } ], "rank": 86 }, { "cve": "CVE-2025-8109", "year": 2025, "name": "Dirty Ptrace", "named_from_title": true, "name_source_title": "Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers", "discussion_count": 1, "resource_count": 2, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "memory management or page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "3789ecba9ecdd6b5", "title": "Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers", "year": 2025, "authors": [ "Xingyu Jin", "Martijn Bogaard" ], "primary_url": "https://powerofcommunity.net/2025/slide/x-84592.pdf", "summary_zh": "Dirty Ptrace探讨了内核mmap处理程序中的未记录行为，导致本地特权提升。", "summary_en": "Dirty Ptrace explores undocumented behaviors in kernel mmap handlers leading to local privilege escalation.", "source_markdown": "[2025: \"Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers\" by Xingyu Jin and Martijn Bogaard](https://powerofcommunity.net/2025/slide/x-84592.pdf) [slides] [[video](https://www.youtube.com/watch?v=yAUJFrPjfCI)] [CVE-2024-44068] [CVE‑2025‑23244] [CVE-2025-8109] [CVE-2024-49739]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://powerofcommunity.net/2025/slide/x-84592.pdf", "raw_path": "/raw/2025-vulnerabilities-lpe-dirty-ptrace-exploiting-undocumented-behaviors-in-kernel-mmap-handlers-primary-d057fa.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=yAUJFrPjfCI", "raw_path": "/raw/2025-vulnerabilities-lpe-dirty-ptrace-exploiting-undocumented-behaviors-in-kernel-mmap-handlers-video-61b937db.txt" } ] } ], "rank": 87 }, { "cve": "CVE-2024-1086", "year": 2024, "name": "Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques", "named_from_title": false, "name_source_title": "Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques", "discussion_count": 1, "resource_count": 2, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "e55fc1c0482370eb", "title": "Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques", "year": 2024, "authors": [ "notselwyn" ], "primary_url": "https://pwning.tech/nftables/", "summary_zh": "本文分析了Linux内核中io_uring的新漏洞。", "summary_en": "This article analyzes a new vulnerability in io_uring within the Linux kernel.", "source_markdown": "[2024: \"Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques\" by notselwyn](https://pwning.tech/nftables/) [article] [[exploit](https://github.com/Notselwyn/CVE-2024-1086)] [CVE-2024-1086]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://pwning.tech/nftables/", "raw_path": "/raw/2024-vulnerabilities-lpe-flipping-pages-an-analysis-of-a-new-linux-vulnerability-in-nf-tables-and-hardened-exp.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/Notselwyn/CVE-2024-1086", "raw_path": "/raw/2024-vulnerabilities-lpe-flipping-pages-an-analysis-of-a-new-linux-vulnerability-in-nf-tables-and-hardened-exp-2.txt" } ] } ], "rank": 88 }, { "cve": "CVE-2024-41009", "year": 2024, "name": "Linux eBPF Design and Vulnerability Case Study", "named_from_title": false, "name_source_title": "Linux eBPF Design and Vulnerability Case Study", "discussion_count": 1, "resource_count": 2, "component_id": "ebpf", "component_label": "eBPF / verifier", "component_detail": "eBPF/verifier", "kernel_location": "kernel/bpf/ + net/core/filter.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "3b20bb459935ccff", "title": "Linux eBPF Design and Vulnerability Case Study", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/07/12/linux-eBPF-design-and-vulnerability-case-study-part-1.html", "summary_zh": "提供了关于Linux eBPF设计和漏洞的案例研究。", "summary_en": "A case study on Linux eBPF design and vulnerabilities is presented.", "source_markdown": "[2024: \"Linux eBPF Design and Vulnerability Case Study\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/07/12/linux-eBPF-design-and-vulnerability-case-study-part-1.html) [article] [[part 2](https://u1f383.github.io/linux/2024/07/20/linux-eBPF-design-and-vulnerability-case-study-part-2.html)] [CVE-2024-41009] [CVE-2022-23222] [CVE-2023-52447]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/07/12/linux-eBPF-design-and-vulnerability-case-study-part-1.html", "raw_path": "/raw/2024-vulnerabilities-other-linux-ebpf-design-and-vulnerability-case-study-primary-661420eb.txt" }, { "label": "part 2", "type": "article", "url": "https://u1f383.github.io/linux/2024/07/20/linux-eBPF-design-and-vulnerability-case-study-part-2.html", "raw_path": "/raw/2024-vulnerabilities-other-linux-ebpf-design-and-vulnerability-case-study-part-2-1c7b257f.txt" } ] } ], "rank": 89 }, { "cve": "CVE-2024-49739", "year": 2024, "name": "Dirty Ptrace", "named_from_title": true, "name_source_title": "Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers", "discussion_count": 1, "resource_count": 2, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "memory management or page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "3789ecba9ecdd6b5", "title": "Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers", "year": 2025, "authors": [ "Xingyu Jin", "Martijn Bogaard" ], "primary_url": "https://powerofcommunity.net/2025/slide/x-84592.pdf", "summary_zh": "Dirty Ptrace探讨了内核mmap处理程序中的未记录行为，导致本地特权提升。", "summary_en": "Dirty Ptrace explores undocumented behaviors in kernel mmap handlers leading to local privilege escalation.", "source_markdown": "[2025: \"Dirty Ptrace: Exploiting Undocumented Behaviors in Kernel mmap Handlers\" by Xingyu Jin and Martijn Bogaard](https://powerofcommunity.net/2025/slide/x-84592.pdf) [slides] [[video](https://www.youtube.com/watch?v=yAUJFrPjfCI)] [CVE-2024-44068] [CVE‑2025‑23244] [CVE-2025-8109] [CVE-2024-49739]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://powerofcommunity.net/2025/slide/x-84592.pdf", "raw_path": "/raw/2025-vulnerabilities-lpe-dirty-ptrace-exploiting-undocumented-behaviors-in-kernel-mmap-handlers-primary-d057fa.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=yAUJFrPjfCI", "raw_path": "/raw/2025-vulnerabilities-lpe-dirty-ptrace-exploiting-undocumented-behaviors-in-kernel-mmap-handlers-video-61b937db.txt" } ] } ], "rank": 90 }, { "cve": "CVE-2023-21400", "year": 2023, "name": "Game of Cross Cache: Let's win it in a more effective way!", "named_from_title": false, "name_source_title": "Game of Cross Cache: Let's win it in a more effective way!", "discussion_count": 1, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "d8d78cccd2affc43", "title": "Game of Cross Cache: Let's win it in a more effective way!", "year": 2024, "authors": [ "Le Wu" ], "primary_url": "https://i.blackhat.com/Asia-24/Presentations/Asia-24-Wu-Game-of-Cross-Cache.pdf", "summary_zh": "本幻灯片演示探讨了利用跨缓存漏洞的新技术。", "summary_en": "This slide presentation explores a new technique for exploiting cross-cache vulnerabilities.", "source_markdown": "[2024: \"Game of Cross Cache: Let's win it in a more effective way!\" by Le Wu](https://i.blackhat.com/Asia-24/Presentations/Asia-24-Wu-Game-of-Cross-Cache.pdf) [slides] [[video](https://www.youtube.com/watch?v=em9qgHm3uIk)] [CVE-2023-21400]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/Asia-24/Presentations/Asia-24-Wu-Game-of-Cross-Cache.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-game-of-cross-cache-let-s-win-it-in-a-more-effective-way-primary-f4ccc450.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=em9qgHm3uIk", "raw_path": "/raw/2024-vulnerabilities-lpe-game-of-cross-cache-let-s-win-it-in-a-more-effective-way-video-355052e4.txt" } ] } ], "rank": 91 }, { "cve": "CVE-2023-31248", "year": 2023, "name": "Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel", "named_from_title": false, "name_source_title": "Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel", "discussion_count": 1, "resource_count": 2, "component_id": "architecture", "component_label": "CPU architecture / side channels", "component_detail": "architecture-specific path", "kernel_location": "arch/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "dafee7a204c11214", "title": "Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel", "year": 2024, "authors": [ "Mingi Cho", "Wongi Lee" ], "primary_url": "https://www.hexacon.fr/slides/Cho_Lee-Utilizing_Cross-CPU_Allocation_to_Exploit_Preempt-Disabled_Linux_Kernel.pdf", "summary_zh": "幻灯片详细介绍了使用跨CPU分配技术利用禁用抢占的Linux内核。", "summary_en": "Slides detailing the exploitation of preempt-disabled Linux kernel using cross-CPU allocation techniques.", "source_markdown": "[2024: \"Utilizing Cross-CPU Allocation to Exploit Preempt-Disabled Linux Kernel\" by Mingi Cho and Wongi Lee](https://www.hexacon.fr/slides/Cho_Lee-Utilizing_Cross-CPU_Allocation_to_Exploit_Preempt-Disabled_Linux_Kernel.pdf) [slides] [CVE-2023-31248] [[video](https://www.youtube.com/watch?v=dUdU0lp35xU)] [CVE-2024-36978]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "slides", "url": "https://www.hexacon.fr/slides/Cho_Lee-Utilizing_Cross-CPU_Allocation_to_Exploit_Preempt-Disabled_Linux_Kernel.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-utilizing-cross-cpu-allocation-to-exploit-preempt-disabled-linux-kernel-primary-77685.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=dUdU0lp35xU", "raw_path": "/raw/2024-vulnerabilities-lpe-utilizing-cross-cpu-allocation-to-exploit-preempt-disabled-linux-kernel-video-2ffddc1.txt" } ] } ], "rank": 92 }, { "cve": "CVE-2023-52447", "year": 2023, "name": "Linux eBPF Design and Vulnerability Case Study", "named_from_title": false, "name_source_title": "Linux eBPF Design and Vulnerability Case Study", "discussion_count": 1, "resource_count": 2, "component_id": "ebpf", "component_label": "eBPF / verifier", "component_detail": "eBPF/verifier", "kernel_location": "kernel/bpf/ + net/core/filter.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "3b20bb459935ccff", "title": "Linux eBPF Design and Vulnerability Case Study", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/07/12/linux-eBPF-design-and-vulnerability-case-study-part-1.html", "summary_zh": "提供了关于Linux eBPF设计和漏洞的案例研究。", "summary_en": "A case study on Linux eBPF design and vulnerabilities is presented.", "source_markdown": "[2024: \"Linux eBPF Design and Vulnerability Case Study\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/07/12/linux-eBPF-design-and-vulnerability-case-study-part-1.html) [article] [[part 2](https://u1f383.github.io/linux/2024/07/20/linux-eBPF-design-and-vulnerability-case-study-part-2.html)] [CVE-2024-41009] [CVE-2022-23222] [CVE-2023-52447]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/07/12/linux-eBPF-design-and-vulnerability-case-study-part-1.html", "raw_path": "/raw/2024-vulnerabilities-other-linux-ebpf-design-and-vulnerability-case-study-primary-661420eb.txt" }, { "label": "part 2", "type": "article", "url": "https://u1f383.github.io/linux/2024/07/20/linux-eBPF-design-and-vulnerability-case-study-part-2.html", "raw_path": "/raw/2024-vulnerabilities-other-linux-ebpf-design-and-vulnerability-case-study-part-2-1c7b257f.txt" } ] } ], "rank": 93 }, { "cve": "CVE-2022-2590", "year": 2022, "name": "The Evolution of Dirty COW", "named_from_title": false, "name_source_title": "The Evolution of Dirty COW", "discussion_count": 1, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "a77bc705a62ebf37", "title": "The Evolution of Dirty COW", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/03/27/the-evolution-of-COW-1.html", "summary_zh": "本文探讨了Dirty COW漏洞的发展历程。", "summary_en": "The evolution of the Dirty COW vulnerability is explored in this article.", "source_markdown": "[2025: \"The Evolution of Dirty COW\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/03/27/the-evolution-of-COW-1.html) [article] [[part 2](https://u1f383.github.io/linux/2025/03/29/the-evolution-of-COW-2.html)] [CVE-2016-5195] [CVE-2017-1000405] [CVE-2022-2590]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/03/27/the-evolution-of-COW-1.html", "raw_path": "/raw/2025-vulnerabilities-other-the-evolution-of-dirty-cow-primary-b5778222.txt" }, { "label": "part 2", "type": "article", "url": "https://u1f383.github.io/linux/2025/03/29/the-evolution-of-COW-2.html", "raw_path": "/raw/2025-vulnerabilities-other-the-evolution-of-dirty-cow-part-2-4a605558.txt" } ] } ], "rank": 94 }, { "cve": "CVE-2021-3573", "year": 2021, "name": "Blue Klotski", "named_from_title": true, "name_source_title": "Blue Klotski (CVE-2021-3573) and the story for fixing", "discussion_count": 1, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "0986be83950c1c9c", "title": "Blue Klotski (CVE-2021-3573) and the story for fixing", "year": 2021, "authors": [ "f0rm2l1n" ], "primary_url": "https://f0rm2l1n.github.io/2021-07-23-Blue-Klotski/", "summary_zh": "CVE-2021-3573，称为Blue Klotski，是Linux内核中的本地权限提升漏洞。", "summary_en": "CVE-2021-3573, known as Blue Klotski, is a local privilege escalation vulnerability in the Linux kernel.", "source_markdown": "[2021: \"Blue Klotski (CVE-2021-3573) and the story for fixing\" by f0rm2l1n](https://f0rm2l1n.github.io/2021-07-23-Blue-Klotski/) [article] [[announcement](https://www.openwall.com/lists/oss-security/2021/06/08/2)] [CVE-2021-3573]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://f0rm2l1n.github.io/2021-07-23-Blue-Klotski/", "raw_path": "/raw/2021-vulnerabilities-lpe-blue-klotski-cve-2021-3573-and-the-story-for-fixing-primary-f301ee48.txt" }, { "label": "announcement", "type": "announcement", "url": "https://www.openwall.com/lists/oss-security/2021/06/08/2", "raw_path": "/raw/2021-vulnerabilities-lpe-blue-klotski-cve-2021-3573-and-the-story-for-fixing-announcement-acd3f6a3.txt" } ] } ], "rank": 95 }, { "cve": "CVE-2021-3609", "year": 2021, "name": "CAN BCM local privilege escalation", "named_from_title": false, "name_source_title": "CVE-2021-3609: CAN BCM local privilege escalation", "discussion_count": 1, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "5f5c545687440367", "title": "CVE-2021-3609: CAN BCM local privilege escalation", "year": 2021, "authors": [], "primary_url": "https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md", "summary_zh": "该文章涵盖了CAN BCM中的本地权限提升（CVE-2021-3609）。", "summary_en": "This article covers local privilege escalation in CAN BCM (CVE-2021-3609).", "source_markdown": "[2021: \"CVE-2021-3609: CAN BCM local privilege escalation\"](https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md) [article] [[announcement](https://www.openwall.com/lists/oss-security/2021/06/19/1)] [CVE-2021-3609]", "affected_area": "CAN BCM", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md", "raw_path": "/raw/2021-vulnerabilities-lpe-cve-2021-3609-can-bcm-local-privilege-escalation-primary-ecf3b7dc.txt" }, { "label": "announcement", "type": "announcement", "url": "https://www.openwall.com/lists/oss-security/2021/06/19/1", "raw_path": "/raw/2021-vulnerabilities-lpe-cve-2021-3609-can-bcm-local-privilege-escalation-announcement-23ec6cb2.txt" } ] } ], "rank": 96 }, { "cve": "CVE-2021-44733", "year": 2021, "name": "Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem", "named_from_title": false, "name_source_title": "CVE-2021-44733: Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem", "discussion_count": 1, "resource_count": 2, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "device driver", "kernel_location": "drivers/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "0b2bb7f4767a68e5", "title": "CVE-2021-44733: Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem", "year": 2021, "authors": [ "pjlantz" ], "primary_url": "https://github.com/pjlantz/optee-qemu", "summary_zh": "涵盖了Linux内核TEE子系统中的使用后释放漏洞CVE-2021-44733的模糊测试和利用。", "summary_en": "Covers fuzzing and exploitation of a use-after-free vulnerability in the Linux kernel TEE subsystem, CVE-2021-44733.", "source_markdown": "[2021: \"CVE-2021-44733: Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem\" by pjlantz](https://github.com/pjlantz/optee-qemu) [article] [[poc](https://github.com/pjlantz/optee_examples/tree/master/exploit/host)] [CVE-2021-44733]", "affected_area": "TEE Subsystem", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/pjlantz/optee-qemu", "raw_path": "/raw/2021-vulnerabilities-other-cve-2021-44733-fuzzing-and-exploitation-of-a-use-after-free-in-the-linux-kernel-tee.txt" }, { "label": "poc", "type": "poc", "url": "https://github.com/pjlantz/optee_examples/tree/master/exploit/host", "raw_path": "/raw/2021-vulnerabilities-other-cve-2021-44733-fuzzing-and-exploitation-of-a-use-after-free-in-the-linux-kernel-tee-2.txt" } ] } ], "rank": 97 }, { "cve": "CVE-2025-37947", "year": 2025, "name": "ksmbd - Exploiting CVE-2025-37947", "named_from_title": false, "name_source_title": "ksmbd - Exploiting CVE-2025-37947", "discussion_count": 1, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "bc84d38c5dca8a7d", "title": "ksmbd - Exploiting CVE-2025-37947", "year": 2025, "authors": [ "Norbert Szetei" ], "primary_url": "https://blog.doyensec.com/2025/10/08/ksmbd-3.html", "summary_zh": "一篇详细介绍在ksmbd中利用本地特权升级漏洞的文章。", "summary_en": "An article detailing the exploitation of a local privilege escalation vulnerability in ksmbd.", "source_markdown": "[2025: \"ksmbd - Exploiting CVE-2025-37947\" by Norbert Szetei](https://blog.doyensec.com/2025/10/08/ksmbd-3.html) [article] [CVE-2025-37947] [[exploit](https://github.com/doyensec/KSMBD-CVE-2025-37947)]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.doyensec.com/2025/10/08/ksmbd-3.html", "raw_path": "/raw/2025-vulnerabilities-lpe-ksmbd-exploiting-cve-2025-37947-primary-d5beb9ae.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/doyensec/KSMBD-CVE-2025-37947", "raw_path": "/raw/2025-vulnerabilities-lpe-ksmbd-exploiting-cve-2025-37947-exploit-9c739ddb.txt" } ] } ], "rank": 98 }, { "cve": "CVE-2024-26925", "year": 2024, "name": "Clash, Burn, and Exploit: Manipulate Filters to Pwn kernelCTF", "named_from_title": false, "name_source_title": "Clash, Burn, and Exploit: Manipulate Filters to Pwn kernelCTF", "discussion_count": 1, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "a0f3eb9300e36922", "title": "Clash, Burn, and Exploit: Manipulate Filters to Pwn kernelCTF", "year": 2024, "authors": [ "HexRabbit" ], "primary_url": "https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20HexRabbit%20Chen%20-%20Clash%2C%20Burn%2C%20and%20Exploit%20-%20Manipulate%20Filters%20to%20Pwn%20kernelCTF.pdf", "summary_zh": "讨论操纵过滤器以利用kernelCTF挑战的幻灯片。", "summary_en": "Slides discussing manipulation of filters to exploit kernelCTF challenges.", "source_markdown": "[2024: \"Clash, Burn, and Exploit: Manipulate Filters to Pwn kernelCTF\" by HexRabbit](https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20HexRabbit%20Chen%20-%20Clash%2C%20Burn%2C%20and%20Exploit%20-%20Manipulate%20Filters%20to%20Pwn%20kernelCTF.pdf) [slides] [[video](https://www.youtube.com/watch?v=_1DTkkaNqfM)] [CVE-2024-26925]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "slides", "url": "https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20HexRabbit%20Chen%20-%20Clash%2C%20Burn%2C%20and%20Exploit%20-%20Manipulate%20Filters%20to%20Pwn%20kernelCTF.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-clash-burn-and-exploit-manipulate-filters-to-pwn-kernelctf-primary-27bab9de.txt" }, { "label": "video", "type": "video", "url": "https://www.youtube.com/watch?v=_1DTkkaNqfM", "raw_path": "/raw/2024-vulnerabilities-lpe-clash-burn-and-exploit-manipulate-filters-to-pwn-kernelctf-video-05d98192.txt" } ] } ], "rank": 99 }, { "cve": "CVE-2023-3390", "year": 2023, "name": "One shot, Triple kill: Pwning all three Google kernelCTF instances with a single 1-day Linux vulnerability", "named_from_title": false, "name_source_title": "One shot, Triple kill: Pwning all three Google kernelCTF instances with a single 1-day Linux vulnerability", "discussion_count": 1, "resource_count": 2, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "e408cca7f20accd4", "title": "One shot, Triple kill: Pwning all three Google kernelCTF instances with a single 1-day Linux vulnerability", "year": 2023, "authors": [], "primary_url": "https://kaist-hacking.github.io/pubs/2023/kim:kernel-ctf-slides.pdf", "summary_zh": "关于利用影响多个Google kernelCTF实例的单日Linux漏洞的幻灯片。", "summary_en": "Slides on exploiting a single-day Linux vulnerability affecting multiple Google kernelCTF instances.", "source_markdown": "[2023: \"One shot, Triple kill: Pwning all three Google kernelCTF instances with a single 1-day Linux vulnerability\"](https://kaist-hacking.github.io/pubs/2023/kim:kernel-ctf-slides.pdf) [slides] [[abstract](https://kaist-hacking.github.io/publication/kim-kernel-ctf/)] [CVE-2023-3390]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://kaist-hacking.github.io/pubs/2023/kim:kernel-ctf-slides.pdf", "raw_path": "/raw/2023-vulnerabilities-lpe-one-shot-triple-kill-pwning-all-three-google-kernelctf-instances-with-a-single-1-day-.txt" }, { "label": "abstract", "type": "abstract", "url": "https://kaist-hacking.github.io/publication/kim-kernel-ctf/", "raw_path": "/raw/2023-vulnerabilities-lpe-one-shot-triple-kill-pwning-all-three-google-kernelctf-instances-with-a-single-1-day--2.txt" } ] } ], "rank": 100 }, { "cve": "CVE-2023-3865", "year": 2023, "name": "Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980", "named_from_title": false, "name_source_title": "Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)", "discussion_count": 1, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "5780f4be6091f33e", "title": "Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)", "year": 2023, "authors": [ "notselwyn" ], "primary_url": "https://pwning.tech/ksmbd/", "summary_zh": "本文讨论了通过ksmbd对Linux内核的远程利用技术。", "summary_en": "The article discusses remote exploitation techniques for the Linux kernel via ksmbd.", "source_markdown": "[2023: \"Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)\" by notselwyn](https://pwning.tech/ksmbd/) [article] [CVE-2023-3866] [CVE-2023-3865] [[exploits](https://github.com/Notselwyn/exploits)]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://pwning.tech/ksmbd/", "raw_path": "/raw/2023-vulnerabilities-other-unleashing-ksmbd-remote-exploitation-of-the-linux-kernel-zdi-23-979-zdi-23-980-prim.txt" }, { "label": "exploits", "type": "exploit", "url": "https://github.com/Notselwyn/exploits", "raw_path": "/raw/2023-vulnerabilities-other-unleashing-ksmbd-remote-exploitation-of-the-linux-kernel-zdi-23-979-zdi-23-980-expl.txt" } ] } ], "rank": 101 }, { "cve": "CVE-2023-3866", "year": 2023, "name": "Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980", "named_from_title": false, "name_source_title": "Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)", "discussion_count": 1, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "5780f4be6091f33e", "title": "Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)", "year": 2023, "authors": [ "notselwyn" ], "primary_url": "https://pwning.tech/ksmbd/", "summary_zh": "本文讨论了通过ksmbd对Linux内核的远程利用技术。", "summary_en": "The article discusses remote exploitation techniques for the Linux kernel via ksmbd.", "source_markdown": "[2023: \"Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)\" by notselwyn](https://pwning.tech/ksmbd/) [article] [CVE-2023-3866] [CVE-2023-3865] [[exploits](https://github.com/Notselwyn/exploits)]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://pwning.tech/ksmbd/", "raw_path": "/raw/2023-vulnerabilities-other-unleashing-ksmbd-remote-exploitation-of-the-linux-kernel-zdi-23-979-zdi-23-980-prim.txt" }, { "label": "exploits", "type": "exploit", "url": "https://github.com/Notselwyn/exploits", "raw_path": "/raw/2023-vulnerabilities-other-unleashing-ksmbd-remote-exploitation-of-the-linux-kernel-zdi-23-979-zdi-23-980-expl.txt" } ] } ], "rank": 102 }, { "cve": "CVE-2023-5178", "year": 2023, "name": "exploiting Linux kernel NVMe-oF-TCP driver on Ubuntu 23.10", "named_from_title": false, "name_source_title": "CVE-2023-5178: exploiting Linux kernel NVMe-oF-TCP driver on Ubuntu 23.10", "discussion_count": 1, "resource_count": 2, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "bb77a6a1dca04b6d", "title": "CVE-2023-5178: exploiting Linux kernel NVMe-oF-TCP driver on Ubuntu 23.10", "year": 2024, "authors": [ "rockrid3r" ], "primary_url": "https://rockrid3r.github.io/2024/02/07/CVE-2023-5178.html", "summary_zh": "讨论在Ubuntu 23.10上利用NVMe-oF-TCP驱动程序中的本地特权升级漏洞的文章。", "summary_en": "An article discussing the exploitation of a local privilege escalation vulnerability in the NVMe-oF-TCP driver on Ubuntu 23.10.", "source_markdown": "[2024: \"CVE-2023-5178: exploiting Linux kernel NVMe-oF-TCP driver on Ubuntu 23.10\" by rockrid3r](https://rockrid3r.github.io/2024/02/07/CVE-2023-5178.html) [article] [CVE-2023-5178] [[exploit](https://github.com/rockrid3r/CVE-2023-5178)]", "affected_area": "driver", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://rockrid3r.github.io/2024/02/07/CVE-2023-5178.html", "raw_path": "/raw/2024-vulnerabilities-lpe-cve-2023-5178-exploiting-linux-kernel-nvme-of-tcp-driver-on-ubuntu-23-10-primary-bc95.txt" }, { "label": "exploit", "type": "exploit", "url": "https://github.com/rockrid3r/CVE-2023-5178", "raw_path": "/raw/2024-vulnerabilities-lpe-cve-2023-5178-exploiting-linux-kernel-nvme-of-tcp-driver-on-ubuntu-23-10-exploit-6541.txt" } ] } ], "rank": 103 }, { "cve": "CVE-2025-36934", "year": 2025, "name": "A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave", "named_from_title": false, "name_source_title": "A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Pixel device driver chain", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "a0b8015507a737e9", "title": "A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave", "year": 2026, "authors": [ "Seth Jenkins" ], "primary_url": "https://projectzero.google/2026/01/pixel-0-click-part-2.html", "summary_zh": "CVE-2025-36934概述了针对Pixel 9沙箱环境的0点击利用链。", "summary_en": "CVE-2025-36934 outlines a 0-click exploit chain targeting the Pixel 9's sandbox environment.", "source_markdown": "[2026: \"A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave\" by Seth Jenkins](https://projectzero.google/2026/01/pixel-0-click-part-2.html) [article] [CVE-2025-36934]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Pixel devices", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://projectzero.google/2026/01/pixel-0-click-part-2.html", "raw_path": "/raw/2026-vulnerabilities-lpe-a-0-click-exploit-chain-for-the-pixel-9-part-2-cracking-the-sandbox-with-a-big-wave-p.txt" } ] } ], "rank": 104 }, { "cve": "CVE-2025-6349", "year": 2025, "name": "Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation", "named_from_title": false, "name_source_title": "Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Pixel device driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "23995725a3b8186e", "title": "Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation", "year": 2025, "authors": [], "primary_url": "https://dawnslab.jd.com/Pixel_9_Pro_EoP/", "summary_zh": "该文章讨论了导致Pixel 9 Pro特权提升的悬空指针和内存问题。", "summary_en": "The article discusses dangling pointers and memory issues leading to privilege escalation on the Pixel 9 Pro.", "source_markdown": "[2025: \"Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation\"](https://dawnslab.jd.com/Pixel_9_Pro_EoP/) [article] [CVE-2025-6349] [CVE-2025-8045]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Pixel devices", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://dawnslab.jd.com/Pixel_9_Pro_EoP/", "raw_path": "/raw/2025-vulnerabilities-lpe-dangling-pointers-fragile-memory-from-an-undisclosed-vulnerability-to-pixel-9-pro-pri.txt" } ] } ], "rank": 105 }, { "cve": "CVE-2025-8045", "year": 2025, "name": "Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation", "named_from_title": false, "name_source_title": "Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Pixel device driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "23995725a3b8186e", "title": "Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation", "year": 2025, "authors": [], "primary_url": "https://dawnslab.jd.com/Pixel_9_Pro_EoP/", "summary_zh": "该文章讨论了导致Pixel 9 Pro特权提升的悬空指针和内存问题。", "summary_en": "The article discusses dangling pointers and memory issues leading to privilege escalation on the Pixel 9 Pro.", "source_markdown": "[2025: \"Dangling pointers, fragile memory—from an undisclosed vulnerability to Pixel 9 Pro privilege escalation\"](https://dawnslab.jd.com/Pixel_9_Pro_EoP/) [article] [CVE-2025-6349] [CVE-2025-8045]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Pixel devices", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://dawnslab.jd.com/Pixel_9_Pro_EoP/", "raw_path": "/raw/2025-vulnerabilities-lpe-dangling-pointers-fragile-memory-from-an-undisclosed-vulnerability-to-pixel-9-pro-pri.txt" } ] } ], "rank": 106 }, { "cve": "CVE-2024-23373", "year": 2024, "name": "GPUAF - Two ways of Rooting All Qualcomm based Android phones", "named_from_title": false, "name_source_title": "GPUAF - Two ways of Rooting All Qualcomm based Android phones", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Qualcomm GPU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "e1cfe8e8185c505b", "title": "GPUAF - Two ways of Rooting All Qualcomm based Android phones", "year": 2024, "authors": [ "Pan Zhenpeng", "Jheng Bing Jhong" ], "primary_url": "https://powerofcommunity.net/poc2024/Pan%20Zhenpeng%20&%20Jheng%20Bing%20Jhong,%20GPUAF%20-%20Two%20ways%20of%20rooting%20All%20Qualcomm%20based%20Android%20phones.pdf", "summary_zh": "2024 年 Linux 内核LPE资料：「GPUAF - Two ways of Rooting All Qualcomm based Android phones」（CVE-2024-23380、CVE-2024-23373）；URL 类型：slides。 Android 影响：yes。", "summary_en": "2024 Linux kernel LPE resource \"GPUAF - Two ways of Rooting All Qualcomm based Android phones\" (CVE-2024-23380, CVE-2024-23373); URL type: slides. Android impact: yes.", "source_markdown": "[2024: \"GPUAF - Two ways of Rooting All Qualcomm based Android phones\" by Pan Zhenpeng and Jheng Bing Jhong](https://powerofcommunity.net/poc2024/Pan%20Zhenpeng%20&%20Jheng%20Bing%20Jhong,%20GPUAF%20-%20Two%20ways%20of%20rooting%20All%20Qualcomm%20based%20Android%20phones.pdf) [slides] [CVE-2024-23380] [CVE-2024-23373]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://powerofcommunity.net/poc2024/Pan%20Zhenpeng%20&%20Jheng%20Bing%20Jhong,%20GPUAF%20-%20Two%20ways%20of%20rooting%20All%20Qualcomm%20based%20Android%20phones.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-gpuaf-two-ways-of-rooting-all-qualcomm-based-android-phones-primary-a6ad2ff2.txt" } ] } ], "rank": 107 }, { "cve": "CVE-2024-46740", "year": 2024, "name": "Breaking through the cage: Get Android universal root", "named_from_title": false, "name_source_title": "Breaking through the cage: Get Android universal root", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "7fd45a04c86e5ea2", "title": "Breaking through the cage: Get Android universal root", "year": 2024, "authors": [ "B-PUAF\" by Lu Yutao", "Ling Hanqin" ], "primary_url": "https://powerofcommunity.net/assets/v0/poc2024/Hanqin%20Ling%20&%20Yutao%20Lu,%20Breaking%20through%20the%20cage%20-%20Get%20Android%20Universal%20Root%20by%20B-PUAF.pdf", "summary_zh": "2024 年 Linux 内核LPE资料：「Breaking through the cage: Get Android universal root」（CVE-2024-46740）；URL 类型：slides。 Android 影响：yes。", "summary_en": "2024 Linux kernel LPE resource \"Breaking through the cage: Get Android universal root\" (CVE-2024-46740); URL type: slides. Android impact: yes.", "source_markdown": "[2024: \"Breaking through the cage: Get Android universal root by B-PUAF\" by Lu Yutao and Ling Hanqin](https://powerofcommunity.net/assets/v0/poc2024/Hanqin%20Ling%20&%20Yutao%20Lu,%20Breaking%20through%20the%20cage%20-%20Get%20Android%20Universal%20Root%20by%20B-PUAF.pdf) [slides] [CVE-2024-46740]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://powerofcommunity.net/assets/v0/poc2024/Hanqin%20Ling%20&%20Yutao%20Lu,%20Breaking%20through%20the%20cage%20-%20Get%20Android%20Universal%20Root%20by%20B-PUAF.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-breaking-through-the-cage-get-android-universal-root-primary-c01916d0.txt" } ] } ], "rank": 108 }, { "cve": "CVE-2023-32878", "year": 2023, "name": "LinkDoor", "named_from_title": true, "name_source_title": "LinkDoor: A Hidden Attack Surface in the Android Netlink Kernel Modules", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "9950368dfc954f9c", "title": "LinkDoor: A Hidden Attack Surface in the Android Netlink Kernel Modules", "year": 2024, "authors": [ "Chao Ma et al." ], "primary_url": "https://i.blackhat.com/Asia-24/Presentations/Asia-24-Ma-LinkDoor-A-Hidden-Attack.pdf", "summary_zh": "本演示揭示了Android Netlink内核模块中的隐藏攻击面。", "summary_en": "This presentation reveals hidden attack surfaces in Android Netlink kernel modules.", "source_markdown": "[2024: \"LinkDoor: A Hidden Attack Surface in the Android Netlink Kernel Modules\" by Chao Ma et al.](https://i.blackhat.com/Asia-24/Presentations/Asia-24-Ma-LinkDoor-A-Hidden-Attack.pdf) [slides] [CVE-2023-32878] [CVE-2023-32882]", "affected_area": "Netlink", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/Asia-24/Presentations/Asia-24-Ma-LinkDoor-A-Hidden-Attack.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-linkdoor-a-hidden-attack-surface-in-the-android-netlink-kernel-modules-primary-393f6a.txt" } ] } ], "rank": 109 }, { "cve": "CVE-2023-32882", "year": 2023, "name": "LinkDoor", "named_from_title": true, "name_source_title": "LinkDoor: A Hidden Attack Surface in the Android Netlink Kernel Modules", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "9950368dfc954f9c", "title": "LinkDoor: A Hidden Attack Surface in the Android Netlink Kernel Modules", "year": 2024, "authors": [ "Chao Ma et al." ], "primary_url": "https://i.blackhat.com/Asia-24/Presentations/Asia-24-Ma-LinkDoor-A-Hidden-Attack.pdf", "summary_zh": "本演示揭示了Android Netlink内核模块中的隐藏攻击面。", "summary_en": "This presentation reveals hidden attack surfaces in Android Netlink kernel modules.", "source_markdown": "[2024: \"LinkDoor: A Hidden Attack Surface in the Android Netlink Kernel Modules\" by Chao Ma et al.](https://i.blackhat.com/Asia-24/Presentations/Asia-24-Ma-LinkDoor-A-Hidden-Attack.pdf) [slides] [CVE-2023-32878] [CVE-2023-32882]", "affected_area": "Netlink", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/Asia-24/Presentations/Asia-24-Ma-LinkDoor-A-Hidden-Attack.pdf", "raw_path": "/raw/2024-vulnerabilities-lpe-linkdoor-a-hidden-attack-surface-in-the-android-netlink-kernel-modules-primary-393f6a.txt" } ] } ], "rank": 110 }, { "cve": "CVE-2023-48409", "year": 2023, "name": "Solo: A Pixel 6 Pro Story (When one bug is all you need", "named_from_title": false, "name_source_title": "Solo: A Pixel 6 Pro Story (When one bug is all you need)", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "96927e08f93d75e6", "title": "Solo: A Pixel 6 Pro Story (When one bug is all you need)", "year": 2025, "authors": [ "Lin Ze Wei" ], "primary_url": "https://starlabs.sg/blog/2025/06-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need/", "summary_zh": "2025 年 Linux 内核LPE资料：「Solo: A Pixel 6 Pro Story (When one bug is all you need)」（CVE-2023-48409、CVE-2023-26083）；URL 类型：article。 Android 影响：yes。", "summary_en": "2025 Linux kernel LPE resource \"Solo: A Pixel 6 Pro Story (When one bug is all you need)\" (CVE-2023-48409, CVE-2023-26083); URL type: article. Android impact: yes.", "source_markdown": "[2025: \"Solo: A Pixel 6 Pro Story (When one bug is all you need)\" by Lin Ze Wei](https://starlabs.sg/blog/2025/06-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need/) [article] [CVE-2023-48409] [CVE-2023-26083]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Pixel devices", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://starlabs.sg/blog/2025/06-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need/", "raw_path": "/raw/2025-vulnerabilities-lpe-solo-a-pixel-6-pro-story-when-one-bug-is-all-you-need-primary-a0052dd5.txt" } ] } ], "rank": 111 }, { "cve": "CVE-2022-20122", "year": 2022, "name": "Android Universal Root: Exploiting xPU Drivers", "named_from_title": false, "name_source_title": "Android Universal Root: Exploiting xPU Drivers", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Android xPU driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "198f71f189ef041b", "title": "Android Universal Root: Exploiting xPU Drivers", "year": 2022, "authors": [], "primary_url": "https://i.blackhat.com/USA-22/Wednesday/US-22-Jin-Android-Universal-Root.pdf", "summary_zh": "该资源讨论了利用xPU驱动程序实现Android通用root访问。", "summary_en": "This resource discusses exploiting xPU drivers for Android universal root access.", "source_markdown": "[2022: \"Android Universal Root: Exploiting xPU Drivers\"](https://i.blackhat.com/USA-22/Wednesday/US-22-Jin-Android-Universal-Root.pdf) [slides] [CVE-2022-20122] [CVE-2021-39815]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/USA-22/Wednesday/US-22-Jin-Android-Universal-Root.pdf", "raw_path": "/raw/2022-vulnerabilities-other-android-universal-root-exploiting-xpu-drivers-primary-2cfbfab5.txt" } ] } ], "rank": 112 }, { "cve": "CVE-2022-22057", "year": 2022, "name": "The Android kernel mitigations obstacle race", "named_from_title": false, "name_source_title": "The Android kernel mitigations obstacle race", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "f14669b6b9355a00", "title": "The Android kernel mitigations obstacle race", "year": 2022, "authors": [ "Man Yue Mo" ], "primary_url": "https://github.blog/2022-06-16-the-android-kernel-mitigations-obstacle-race/", "summary_zh": "一篇讨论Android内核缓解措施及其挑战的文章。", "summary_en": "An article discussing Android kernel mitigations and their challenges.", "source_markdown": "[2022: \"The Android kernel mitigations obstacle race\" by Man Yue Mo](https://github.blog/2022-06-16-the-android-kernel-mitigations-obstacle-race/) [article] [CVE-2022-22057]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.blog/2022-06-16-the-android-kernel-mitigations-obstacle-race/", "raw_path": "/raw/2022-vulnerabilities-lpe-the-android-kernel-mitigations-obstacle-race-primary-2d47dce2.txt" } ] } ], "rank": 113 }, { "cve": "CVE-2022-25664", "year": 2022, "name": "The code that wasn’t there: Reading memory on an Android device", "named_from_title": false, "name_source_title": "The code that wasn’t there: Reading memory on an Android device", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "fb111752b4192ce7", "title": "The code that wasn’t there: Reading memory on an Android device", "year": 2023, "authors": [ "accident\" by Man Yue Mo" ], "primary_url": "https://github.blog/2023-02-23-the-code-that-wasnt-there-reading-memory-on-an-android-device-by-accident/", "summary_zh": "描述了在Android设备上意外读取内存的事件。", "summary_en": "Describes an incident of unintended memory reading on an Android device.", "source_markdown": "[2023: \"The code that wasn’t there: Reading memory on an Android device by accident\" by Man Yue Mo](https://github.blog/2023-02-23-the-code-that-wasnt-there-reading-memory-on-an-android-device-by-accident/) [article] [CVE-2022-25664]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.blog/2023-02-23-the-code-that-wasnt-there-reading-memory-on-an-android-device-by-accident/", "raw_path": "/raw/2023-vulnerabilities-info-leaks-the-code-that-wasn-t-there-reading-memory-on-an-android-device-primary-a366b8c.txt" } ] } ], "rank": 114 }, { "cve": "CVE-2021-25369", "year": 2021, "name": "A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain", "named_from_title": false, "name_source_title": "A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "mobile SoC or accelerator driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "medium", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "2e6abb318a77f4d7", "title": "A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain", "year": 2022, "authors": [ "Maddie Stone" ], "primary_url": "https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html", "summary_zh": "本文分析了利用剪贴板漏洞的三星攻击链。", "summary_en": "This article analyzes a Samsung exploit chain leveraging clipboard vulnerabilities.", "source_markdown": "[2022: \"A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain\" by Maddie Stone](https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html) [article] [CVE-2021-25369] [CVE-2021-25370]", "affected_area": "clipboard", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions an Android OEM/device family", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html", "raw_path": "/raw/2022-vulnerabilities-lpe-a-very-powerful-clipboard-analysis-of-a-samsung-in-the-wild-exploit-chain-primary-144.txt" } ] } ], "rank": 115 }, { "cve": "CVE-2021-25370", "year": 2021, "name": "A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain", "named_from_title": false, "name_source_title": "A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "mobile SoC or accelerator driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "medium", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "2e6abb318a77f4d7", "title": "A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain", "year": 2022, "authors": [ "Maddie Stone" ], "primary_url": "https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html", "summary_zh": "本文分析了利用剪贴板漏洞的三星攻击链。", "summary_en": "This article analyzes a Samsung exploit chain leveraging clipboard vulnerabilities.", "source_markdown": "[2022: \"A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain\" by Maddie Stone](https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html) [article] [CVE-2021-25369] [CVE-2021-25370]", "affected_area": "clipboard", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions an Android OEM/device family", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html", "raw_path": "/raw/2022-vulnerabilities-lpe-a-very-powerful-clipboard-analysis-of-a-samsung-in-the-wild-exploit-chain-primary-144.txt" } ] } ], "rank": 116 }, { "cve": "CVE-2021-39815", "year": 2021, "name": "Android Universal Root: Exploiting xPU Drivers", "named_from_title": false, "name_source_title": "Android Universal Root: Exploiting xPU Drivers", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Android xPU driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "198f71f189ef041b", "title": "Android Universal Root: Exploiting xPU Drivers", "year": 2022, "authors": [], "primary_url": "https://i.blackhat.com/USA-22/Wednesday/US-22-Jin-Android-Universal-Root.pdf", "summary_zh": "该资源讨论了利用xPU驱动程序实现Android通用root访问。", "summary_en": "This resource discusses exploiting xPU drivers for Android universal root access.", "source_markdown": "[2022: \"Android Universal Root: Exploiting xPU Drivers\"](https://i.blackhat.com/USA-22/Wednesday/US-22-Jin-Android-Universal-Root.pdf) [slides] [CVE-2022-20122] [CVE-2021-39815]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/USA-22/Wednesday/US-22-Jin-Android-Universal-Root.pdf", "raw_path": "/raw/2022-vulnerabilities-other-android-universal-root-exploiting-xpu-drivers-primary-2cfbfab5.txt" } ] } ], "rank": 117 }, { "cve": "CVE-2020-3680", "year": 2020, "name": "Three Dark clouds over the Android kernel", "named_from_title": false, "name_source_title": "Three Dark clouds over the Android kernel", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "confirmed", "android_reason": "来源条目明确出现 Android、Pixel 或 Android OEM 发行设备语境。", "android_confirmed_in_sources": true, "has_poc": true, "has_code": true, "has_exploit_link": false, "latest_article_year": 2020, "article_years": [ 2020 ], "items": [ { "item_id": "176bab554fde6042", "title": "Three Dark clouds over the Android kernel", "year": 2020, "authors": [ "Jun Yao" ], "primary_url": "https://github.com/2freeman/Slides/blob/main/PoC-2020-Three%20Dark%20clouds%20over%20the%20Android%20kernel.pdf", "summary_zh": "2020 年 Linux 内核LPE资料：「Three Dark clouds over the Android kernel」（CVE-2020-3680）；URL 类型：slides。 Android 影响：yes。", "summary_en": "2020 Linux kernel LPE resource \"Three Dark clouds over the Android kernel\" (CVE-2020-3680); URL type: slides. Android impact: yes.", "source_markdown": "[2020: \"Three Dark clouds over the Android kernel\" by Jun Yao](https://github.com/2freeman/Slides/blob/main/PoC-2020-Three%20Dark%20clouds%20over%20the%20Android%20kernel.pdf) [slides] [CVE-2020-3680]", "affected_area": "", "android_status": "yes", "android_confirmed": true, "android_reason": "mentions Android", "has_poc": true, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://github.com/2freeman/Slides/blob/main/PoC-2020-Three%20Dark%20clouds%20over%20the%20Android%20kernel.pdf", "raw_path": "/raw/2020-vulnerabilities-lpe-three-dark-clouds-over-the-android-kernel-primary-50628092.txt" } ] } ], "rank": 118 }, { "cve": "CVE-2025-0072", "year": 2025, "name": "Bypassing MTE with CVE-2025-0072", "named_from_title": false, "name_source_title": "Bypassing MTE with CVE-2025-0072", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Mali GPU on MTE-enabled Android", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "723e06e2f92de9fb", "title": "Bypassing MTE with CVE-2025-0072", "year": 2025, "authors": [ "Man Yue Mo" ], "primary_url": "https://github.blog/security/vulnerability-research/bypassing-mte-with-cve-2025-0072/", "summary_zh": "2025 年 Linux 内核LPE资料：「Bypassing MTE with CVE-2025-0072」（CVE-2025-0072）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"Bypassing MTE with CVE-2025-0072\" (CVE-2025-0072); URL type: article.", "source_markdown": "[2025: \"Bypassing MTE with CVE-2025-0072\" by Man Yue Mo](https://github.blog/security/vulnerability-research/bypassing-mte-with-cve-2025-0072/) [article] [CVE-2025-0072]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.blog/security/vulnerability-research/bypassing-mte-with-cve-2025-0072/", "raw_path": "/raw/2025-vulnerabilities-lpe-bypassing-mte-with-cve-2025-0072-primary-603b242e.txt" } ] } ], "rank": 119 }, { "cve": "CVE-2025-23280", "year": 2025, "name": "Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers", "named_from_title": false, "name_source_title": "Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU or IOMMU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "medium", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "16024e97adc4fb39", "title": "Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers", "year": 2025, "authors": [ "Robin Bastide" ], "primary_url": "https://blog.quarkslab.com/nvidia_gpu_kernel_vmalloc_exploit.html", "summary_zh": "本文讨论了NVIDIA GPU Linux驱动程序中的使用后释放漏洞，导致本地特权升级。", "summary_en": "This article discusses a use-after-free vulnerability in NVIDIA's GPU Linux drivers leading to local privilege escalation.", "source_markdown": "[2025: \"Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers\" by Robin Bastide](https://blog.quarkslab.com/nvidia_gpu_kernel_vmalloc_exploit.html) [article] [CVE-2025-23280] [CVE-2025-23330]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.quarkslab.com/nvidia_gpu_kernel_vmalloc_exploit.html", "raw_path": "/raw/2025-vulnerabilities-lpe-oops-it-s-a-kernel-stack-use-after-free-exploiting-nvidia-s-gpu-linux-drivers-primary.txt" } ] } ], "rank": 120 }, { "cve": "CVE-2025-23330", "year": 2025, "name": "Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers", "named_from_title": false, "name_source_title": "Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU or IOMMU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "medium", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "16024e97adc4fb39", "title": "Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers", "year": 2025, "authors": [ "Robin Bastide" ], "primary_url": "https://blog.quarkslab.com/nvidia_gpu_kernel_vmalloc_exploit.html", "summary_zh": "本文讨论了NVIDIA GPU Linux驱动程序中的使用后释放漏洞，导致本地特权升级。", "summary_en": "This article discusses a use-after-free vulnerability in NVIDIA's GPU Linux drivers leading to local privilege escalation.", "source_markdown": "[2025: \"Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers\" by Robin Bastide](https://blog.quarkslab.com/nvidia_gpu_kernel_vmalloc_exploit.html) [article] [CVE-2025-23280] [CVE-2025-23330]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.quarkslab.com/nvidia_gpu_kernel_vmalloc_exploit.html", "raw_path": "/raw/2025-vulnerabilities-lpe-oops-it-s-a-kernel-stack-use-after-free-exploiting-nvidia-s-gpu-linux-drivers-primary.txt" } ] } ], "rank": 121 }, { "cve": "CVE-2025-25180", "year": 2025, "name": "Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space!", "named_from_title": false, "name_source_title": "Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space!", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "mobile GPU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "1758f75c5002a807", "title": "Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space!", "year": 2026, "authors": [ "Xingyu Jin", "Martijn Bogaard" ], "primary_url": "https://www.youtube.com/watch?v=KGbGU_MK9hY", "summary_zh": "该视频讨论了一个GPU漏洞，允许渲染到内核代码空间，从而导致潜在的权限提升。", "summary_en": "This video discusses a GPU vulnerability that allows rendering to kernel code space, leading to potential privilege escalation.", "source_markdown": "[2026: \"Tile-Based Deferred Rooting: When Your GPU Starts Rendering To Kernel Code Space!\" by Xingyu Jin and Martijn Bogaard](https://www.youtube.com/watch?v=KGbGU_MK9hY) [video] [CVE-2025-25180]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=KGbGU_MK9hY", "raw_path": "/raw/2026-vulnerabilities-lpe-tile-based-deferred-rooting-when-your-gpu-starts-rendering-to-kernel-code-space-prima.txt" } ] } ], "rank": 122 }, { "cve": "CVE-2025-47394", "year": 2025, "name": "From Zero To Root: Attacking Qualcomm DSP Driver", "named_from_title": false, "name_source_title": "From Zero To Root: Attacking Qualcomm DSP Driver", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm DSP driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "bc77f54370eba677", "title": "From Zero To Root: Attacking Qualcomm DSP Driver", "year": 2026, "authors": [ "Xiling Gong" ], "primary_url": "https://www.youtube.com/watch?v=TogmH2HEIKM", "summary_zh": "从零到根讨论了攻击 Qualcomm DSP 驱动程序以实现权限提升。", "summary_en": "From Zero To Root discusses attacking the Qualcomm DSP Driver for privilege escalation.", "source_markdown": "[2026: \"From Zero To Root: Attacking Qualcomm DSP Driver\" by Xiling Gong](https://www.youtube.com/watch?v=TogmH2HEIKM) [video] [CVE-2025-47394]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=TogmH2HEIKM", "raw_path": "/raw/2026-vulnerabilities-lpe-from-zero-to-root-attacking-qualcomm-dsp-driver-primary-1ac67675.txt" } ] } ], "rank": 123 }, { "cve": "CVE-2024-23372", "year": 2024, "name": "Skin in the Game: Survival of GPU IOMMU Irregular Damage", "named_from_title": false, "name_source_title": "Skin in the Game: Survival of GPU IOMMU Irregular Damage", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU IOMMU path", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "30ce50bda1587a8d", "title": "Skin in the Game: Survival of GPU IOMMU Irregular Damage", "year": 2025, "authors": [ "Fish", "Ling Hanqin" ], "primary_url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "summary_zh": "2025 年 Linux 内核LPE资料：「Skin in the Game: Survival of GPU IOMMU Irregular Damage」（CVE-2022-38181、CVE-2023-6241、CVE-2023-33107、CVE-2024-23372、CVE-2024-31333）；URL 类型：video。", "summary_en": "2025 Linux kernel LPE resource \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" (CVE-2022-38181, CVE-2023-6241, CVE-2023-33107, CVE-2024-23372, CVE-2024-31333); URL type: video.", "source_markdown": "[2025: \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" by Fish and Ling Hanqin](https://www.youtube.com/watch?v=e4t_xYPOq9w) [video] [CVE-2022-38181] [CVE-2023-6241] [CVE-2023-33107] [CVE-2024-23372] [CVE-2024-31333]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "raw_path": "/raw/2025-vulnerabilities-lpe-skin-in-the-game-survival-of-gpu-iommu-irregular-damage-primary-da1ab36a.txt" } ] } ], "rank": 124 }, { "cve": "CVE-2024-31333", "year": 2024, "name": "Skin in the Game: Survival of GPU IOMMU Irregular Damage", "named_from_title": false, "name_source_title": "Skin in the Game: Survival of GPU IOMMU Irregular Damage", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU IOMMU path", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "30ce50bda1587a8d", "title": "Skin in the Game: Survival of GPU IOMMU Irregular Damage", "year": 2025, "authors": [ "Fish", "Ling Hanqin" ], "primary_url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "summary_zh": "2025 年 Linux 内核LPE资料：「Skin in the Game: Survival of GPU IOMMU Irregular Damage」（CVE-2022-38181、CVE-2023-6241、CVE-2023-33107、CVE-2024-23372、CVE-2024-31333）；URL 类型：video。", "summary_en": "2025 Linux kernel LPE resource \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" (CVE-2022-38181, CVE-2023-6241, CVE-2023-33107, CVE-2024-23372, CVE-2024-31333); URL type: video.", "source_markdown": "[2025: \"Skin in the Game: Survival of GPU IOMMU Irregular Damage\" by Fish and Ling Hanqin](https://www.youtube.com/watch?v=e4t_xYPOq9w) [video] [CVE-2022-38181] [CVE-2023-6241] [CVE-2023-33107] [CVE-2024-23372] [CVE-2024-31333]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=e4t_xYPOq9w", "raw_path": "/raw/2025-vulnerabilities-lpe-skin-in-the-game-survival-of-gpu-iommu-irregular-damage-primary-da1ab36a.txt" } ] } ], "rank": 125 }, { "cve": "CVE-2024-38399", "year": 2024, "name": "Fast & Faulty - A Use After Free in KGSL Fault Handling", "named_from_title": false, "name_source_title": "Fast & Faulty - A Use After Free in KGSL Fault Handling", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "KGSL fault handling", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "e135da0e0305652c", "title": "Fast & Faulty - A Use After Free in KGSL Fault Handling", "year": 2025, "authors": [ "Shreyas Penkar" ], "primary_url": "https://streypaws.github.io/posts/Fast-and-Faulty-A-Use-After-Free-in-KGSL-Fault-Handling/", "summary_zh": "CVE-2024-38399突出了KGSL故障处理中的使用后释放漏洞。", "summary_en": "CVE-2024-38399 highlights a use-after-free vulnerability in KGSL fault handling.", "source_markdown": "[2025: \"Fast & Faulty - A Use After Free in KGSL Fault Handling\" by Shreyas Penkar](https://streypaws.github.io/posts/Fast-and-Faulty-A-Use-After-Free-in-KGSL-Fault-Handling/) [article] [CVE-2024-38399]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions KGSL/Adreno graphics driver", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://streypaws.github.io/posts/Fast-and-Faulty-A-Use-After-Free-in-KGSL-Fault-Handling/", "raw_path": "/raw/2025-vulnerabilities-other-fast-faulty-a-use-after-free-in-kgsl-fault-handling-primary-cc5277df.txt" } ] } ], "rank": 126 }, { "cve": "CVE-2023-33063", "year": 2023, "name": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "named_from_title": false, "name_source_title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU or IOMMU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "medium", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "384b71259a0bffc4", "title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "year": 2023, "authors": [ "Alisa Esage" ], "primary_url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "summary_zh": "本文提供了针对Qualcomm MSM Linux内核和ARM Mali GPU的最新0-day攻击的见解。", "summary_en": "This article provides insights into recent 0-day exploit attacks targeting Qualcomm MSM Linux Kernel and ARM Mali GPU.", "source_markdown": "[2023: \"Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023\" by Alisa Esage](https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html) [article] [CVE-2023-33063] [CVE-2023-33106] [CVE-2023-33107] [CVE-2022-22071] [CVE-2023-4211]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "raw_path": "/raw/2023-vulnerabilities-other-deep-dive-qualcomm-msm-linux-kernel-arm-mali-gpu-0-day-exploit-attacks-of-october-2.txt" } ] } ], "rank": 127 }, { "cve": "CVE-2023-33106", "year": 2023, "name": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "named_from_title": false, "name_source_title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU or IOMMU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "medium", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "384b71259a0bffc4", "title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "year": 2023, "authors": [ "Alisa Esage" ], "primary_url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "summary_zh": "本文提供了针对Qualcomm MSM Linux内核和ARM Mali GPU的最新0-day攻击的见解。", "summary_en": "This article provides insights into recent 0-day exploit attacks targeting Qualcomm MSM Linux Kernel and ARM Mali GPU.", "source_markdown": "[2023: \"Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023\" by Alisa Esage](https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html) [article] [CVE-2023-33063] [CVE-2023-33106] [CVE-2023-33107] [CVE-2022-22071] [CVE-2023-4211]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "raw_path": "/raw/2023-vulnerabilities-other-deep-dive-qualcomm-msm-linux-kernel-arm-mali-gpu-0-day-exploit-attacks-of-october-2.txt" } ] } ], "rank": 128 }, { "cve": "CVE-2023-4211", "year": 2023, "name": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "named_from_title": false, "name_source_title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU or IOMMU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "medium", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "384b71259a0bffc4", "title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "year": 2023, "authors": [ "Alisa Esage" ], "primary_url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "summary_zh": "本文提供了针对Qualcomm MSM Linux内核和ARM Mali GPU的最新0-day攻击的见解。", "summary_en": "This article provides insights into recent 0-day exploit attacks targeting Qualcomm MSM Linux Kernel and ARM Mali GPU.", "source_markdown": "[2023: \"Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023\" by Alisa Esage](https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html) [article] [CVE-2023-33063] [CVE-2023-33106] [CVE-2023-33107] [CVE-2022-22071] [CVE-2023-4211]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "raw_path": "/raw/2023-vulnerabilities-other-deep-dive-qualcomm-msm-linux-kernel-arm-mali-gpu-0-day-exploit-attacks-of-october-2.txt" } ] } ], "rank": 129 }, { "cve": "CVE-2023-42483", "year": 2023, "name": "Attacking NPUs of Multiple Platforms", "named_from_title": false, "name_source_title": "Attacking NPUs of Multiple Platforms", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "mobile SoC or accelerator driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "medium", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "b1cafe59e420c497", "title": "Attacking NPUs of Multiple Platforms", "year": 2023, "authors": [], "primary_url": "https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf", "summary_zh": "这些幻灯片涵盖了多个平台上与NPU相关的漏洞。", "summary_en": "The slides cover vulnerabilities related to NPUs across multiple platforms.", "source_markdown": "[2023: \"Attacking NPUs of Multiple Platforms\"](https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf) [slides] [CVE-2022-22265] [CVE-2020-28343] [SVE-2021-20204] [CVE-2023-42483] [CVE-2023-45864]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf", "raw_path": "/raw/2023-vulnerabilities-other-attacking-npus-of-multiple-platforms-primary-e362137b.txt" } ] } ], "rank": 130 }, { "cve": "CVE-2023-45864", "year": 2023, "name": "Attacking NPUs of Multiple Platforms", "named_from_title": false, "name_source_title": "Attacking NPUs of Multiple Platforms", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "mobile SoC or accelerator driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "medium", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "b1cafe59e420c497", "title": "Attacking NPUs of Multiple Platforms", "year": 2023, "authors": [], "primary_url": "https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf", "summary_zh": "这些幻灯片涵盖了多个平台上与NPU相关的漏洞。", "summary_en": "The slides cover vulnerabilities related to NPUs across multiple platforms.", "source_markdown": "[2023: \"Attacking NPUs of Multiple Platforms\"](https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf) [slides] [CVE-2022-22265] [CVE-2020-28343] [SVE-2021-20204] [CVE-2023-42483] [CVE-2023-45864]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://i.blackhat.com/EU-23/Presentations/EU-23-Zhang-Attacking-NPUs-of-Multiple-Platforms.pdf", "raw_path": "/raw/2023-vulnerabilities-other-attacking-npus-of-multiple-platforms-primary-e362137b.txt" } ] } ], "rank": 131 }, { "cve": "CVE-2022-22071", "year": 2022, "name": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "named_from_title": false, "name_source_title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "GPU or IOMMU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "medium", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "384b71259a0bffc4", "title": "Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023", "year": 2023, "authors": [ "Alisa Esage" ], "primary_url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "summary_zh": "本文提供了针对Qualcomm MSM Linux内核和ARM Mali GPU的最新0-day攻击的见解。", "summary_en": "This article provides insights into recent 0-day exploit attacks targeting Qualcomm MSM Linux Kernel and ARM Mali GPU.", "source_markdown": "[2023: \"Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023\" by Alisa Esage](https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html) [article] [CVE-2023-33063] [CVE-2023-33106] [CVE-2023-33107] [CVE-2022-22071] [CVE-2023-4211]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://zerodayengineering.com/insights/qualcomm-msm-arm-mali-0days.html", "raw_path": "/raw/2023-vulnerabilities-other-deep-dive-qualcomm-msm-linux-kernel-arm-mali-gpu-0-day-exploit-attacks-of-october-2.txt" } ] } ], "rank": 132 }, { "cve": "CVE-2021-1905", "year": 2021, "name": "Qualcomm Adreno GPU memory mapping use-after-free", "named_from_title": false, "name_source_title": "CVE-2021-1905: Qualcomm Adreno GPU memory mapping use-after-free", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Qualcomm Adreno GPU", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "176e29b99ce37f1e", "title": "CVE-2021-1905: Qualcomm Adreno GPU memory mapping use-after-free", "year": 2021, "authors": [ "Ben Hawkes" ], "primary_url": "https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1905.html", "summary_zh": "讨论了Qualcomm Adreno GPU内存映射中的使用后释放漏洞CVE-2021-1905。", "summary_en": "Discusses a use-after-free vulnerability in Qualcomm Adreno GPU memory mapping, CVE-2021-1905.", "source_markdown": "[2021: \"CVE-2021-1905: Qualcomm Adreno GPU memory mapping use-after-free\" by Ben Hawkes](https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1905.html) [article] [CVE-2021-1905]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1905.html", "raw_path": "/raw/2021-vulnerabilities-other-cve-2021-1905-qualcomm-adreno-gpu-memory-mapping-use-after-free-primary-2ff6e511.txt" } ] } ], "rank": 133 }, { "cve": "CVE-2021-1940", "year": 2021, "name": "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver", "named_from_title": false, "name_source_title": "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm NPU driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "86793903b0c37afa", "title": "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver", "year": 2021, "authors": [ "Man Yue Mo" ], "primary_url": "https://securitylab.github.com/research/qualcomm_npu/", "summary_zh": "本文详细介绍了对高通NPU内核驱动程序漏洞的利用。", "summary_en": "This article details the exploitation of vulnerabilities in the Qualcomm NPU kernel driver.", "source_markdown": "[2021: \"Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver\" by Man Yue Mo](https://securitylab.github.com/research/qualcomm_npu/) [article] [CVE-2021-1940, CVE-2021-1968, CVE-2021-1969]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://securitylab.github.com/research/qualcomm_npu/", "raw_path": "/raw/2021-vulnerabilities-lpe-fall-of-the-machines-exploiting-the-qualcomm-npu-neural-processing-unit-kernel-driver.txt" } ] } ], "rank": 134 }, { "cve": "CVE-2021-1968", "year": 2021, "name": "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver", "named_from_title": false, "name_source_title": "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm NPU driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "86793903b0c37afa", "title": "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver", "year": 2021, "authors": [ "Man Yue Mo" ], "primary_url": "https://securitylab.github.com/research/qualcomm_npu/", "summary_zh": "本文详细介绍了对高通NPU内核驱动程序漏洞的利用。", "summary_en": "This article details the exploitation of vulnerabilities in the Qualcomm NPU kernel driver.", "source_markdown": "[2021: \"Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver\" by Man Yue Mo](https://securitylab.github.com/research/qualcomm_npu/) [article] [CVE-2021-1940, CVE-2021-1968, CVE-2021-1969]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://securitylab.github.com/research/qualcomm_npu/", "raw_path": "/raw/2021-vulnerabilities-lpe-fall-of-the-machines-exploiting-the-qualcomm-npu-neural-processing-unit-kernel-driver.txt" } ] } ], "rank": 135 }, { "cve": "CVE-2021-1969", "year": 2021, "name": "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver", "named_from_title": false, "name_source_title": "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-soc", "component_label": "Mobile SoC / accelerator drivers", "component_detail": "Qualcomm NPU driver", "kernel_location": "vendor drivers (NPU, DSP, camera, xPU)", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "86793903b0c37afa", "title": "Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver", "year": 2021, "authors": [ "Man Yue Mo" ], "primary_url": "https://securitylab.github.com/research/qualcomm_npu/", "summary_zh": "本文详细介绍了对高通NPU内核驱动程序漏洞的利用。", "summary_en": "This article details the exploitation of vulnerabilities in the Qualcomm NPU kernel driver.", "source_markdown": "[2021: \"Fall of the machines: Exploiting the Qualcomm NPU (neural processing unit) kernel driver\" by Man Yue Mo](https://securitylab.github.com/research/qualcomm_npu/) [article] [CVE-2021-1940, CVE-2021-1968, CVE-2021-1969]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://securitylab.github.com/research/qualcomm_npu/", "raw_path": "/raw/2021-vulnerabilities-lpe-fall-of-the-machines-exploiting-the-qualcomm-npu-neural-processing-unit-kernel-driver.txt" } ] } ], "rank": 136 }, { "cve": "CVE-2021-39793", "year": 2021, "name": "Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793", "named_from_title": false, "name_source_title": "Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Mali GPU driver", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "8d4f27b8f2a1c824", "title": "Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)", "year": 2025, "authors": [ "Ng Zhi Yang" ], "primary_url": "https://starlabs.sg/blog/2025/12-mali-cious-intent-exploiting-gpu-vulnerabilities-cve-2022-22706/", "summary_zh": "2025 年 Linux 内核LPE资料：「Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)」（CVE-2022-22706、CVE-2021-39793）；URL 类型：article。 Android 影响：possible。", "summary_en": "2025 Linux kernel LPE resource \"Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)\" (CVE-2022-22706, CVE-2021-39793); URL type: article. Android impact: possible.", "source_markdown": "[2025: \"Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793)\" by Ng Zhi Yang](https://starlabs.sg/blog/2025/12-mali-cious-intent-exploiting-gpu-vulnerabilities-cve-2022-22706/) [article] [CVE-2022-22706] [CVE-2021-39793]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions mobile SoC/GPU components used by Android devices", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://starlabs.sg/blog/2025/12-mali-cious-intent-exploiting-gpu-vulnerabilities-cve-2022-22706/", "raw_path": "/raw/2025-vulnerabilities-lpe-mali-cious-intent-exploiting-gpu-vulnerabilities-cve-2022-22706-cve-2021-39793-primar.txt" } ] } ], "rank": 137 }, { "cve": "CVE-2020-11179", "year": 2020, "name": "Attacking the Qualcomm Adreno GPU", "named_from_title": false, "name_source_title": "Attacking the Qualcomm Adreno GPU", "discussion_count": 1, "resource_count": 1, "component_id": "mobile-gpu", "component_label": "Mobile GPU / IOMMU", "component_detail": "Qualcomm Adreno GPU", "kernel_location": "drivers/gpu/ + vendor GPU drivers", "component_confidence": "high", "android_priority": "high", "android_reason": "位于 Android 专用接口或移动 SoC 常见驱动面，优先核对厂商内核版本和补丁回移。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2020, "article_years": [ 2020 ], "items": [ { "item_id": "da4252bcf712fd52", "title": "Attacking the Qualcomm Adreno GPU", "year": 2020, "authors": [ "Ben Hawkes" ], "primary_url": "https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html", "summary_zh": "2020 年 Linux 内核LPE资料：「Attacking the Qualcomm Adreno GPU」（CVE-2020-11179）；URL 类型：article。 Android 影响：possible。", "summary_en": "2020 Linux kernel LPE resource \"Attacking the Qualcomm Adreno GPU\" (CVE-2020-11179); URL type: article. Android impact: possible.", "source_markdown": "[2020: \"Attacking the Qualcomm Adreno GPU\" by Ben Hawkes](https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html) [article] [CVE-2020-11179]", "affected_area": "", "android_status": "possible", "android_confirmed": false, "android_reason": "mentions Qualcomm/Adreno Android SoC components", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html", "raw_path": "/raw/2020-vulnerabilities-lpe-attacking-the-qualcomm-adreno-gpu-primary-2e49e642.txt" } ] } ], "rank": 138 }, { "cve": "CVE-2026-23111", "year": 2026, "name": "Reproducing CVE-2026-23111: How one character can change everything", "named_from_title": false, "name_source_title": "Reproducing CVE-2026-23111: How one character can change everything", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "bc7bf6976aea428e", "title": "Reproducing CVE-2026-23111: How one character can change everything", "year": 2026, "authors": [], "primary_url": "https://fuzzinglabs.com/repro-cve-2026-23111/", "summary_zh": "这篇文章重现了被识别为CVE-2026-23111的漏洞，展示了其影响。", "summary_en": "This article reproduces a vulnerability identified as CVE-2026-23111, showcasing its impact.", "source_markdown": "[2026: \"Reproducing CVE-2026-23111: How one character can change everything\"](https://fuzzinglabs.com/repro-cve-2026-23111/) [article] [CVE-2026-23111]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://fuzzinglabs.com/repro-cve-2026-23111/", "raw_path": "/raw/2026-vulnerabilities-lpe-reproducing-cve-2026-23111-how-one-character-can-change-everything-primary-a71c1728.txt" } ] } ], "rank": 139 }, { "cve": "CVE-2026-23239", "year": 2026, "name": "Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs", "named_from_title": false, "name_source_title": "Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs", "discussion_count": 1, "resource_count": 1, "component_id": "core-kernel", "component_label": "Core kernel / task lifetime", "component_detail": "core kernel lifetime or task path", "kernel_location": "kernel/ + fs/exec.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "3293eb4912808c5d", "title": "Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs", "year": 2026, "authors": [], "primary_url": "https://v4bel.github.io/linux/2026/03/23/ooc.html", "summary_zh": "一篇文章讨论了根植于工作队列取消API的漏洞类别，可能导致权限提升。", "summary_en": "An article discussing a vulnerability class rooted in workqueue cancellation APIs that may lead to privilege escalation.", "source_markdown": "[2026: \"Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs\"](https://v4bel.github.io/linux/2026/03/23/ooc.html) [article] [CVE-2026-23239]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://v4bel.github.io/linux/2026/03/23/ooc.html", "raw_path": "/raw/2026-vulnerabilities-lpe-out-of-cancel-a-vulnerability-class-rooted-in-workqueue-cancellation-apis-primary-f5b.txt" } ] } ], "rank": 140 }, { "cve": "CVE-2026-23275", "year": 2026, "name": "My First CVE - CVE-2026-23275 - io uring resize and taskrun race condition", "named_from_title": false, "name_source_title": "My First CVE - CVE-2026-23275 - io uring resize and taskrun race condition", "discussion_count": 1, "resource_count": 1, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "5c4fecf6ec12a71e", "title": "My First CVE - CVE-2026-23275 - io uring resize and taskrun race condition", "year": 2026, "authors": [], "primary_url": "https://naup.mygo.tw/2026/03/23/My-First-CVE-CVE-2026-23275/", "summary_zh": "CVE-2026-23275涉及io uring调整大小和taskrun中的竞争条件。", "summary_en": "CVE-2026-23275 addresses a race condition in io uring resize and taskrun.", "source_markdown": "[2026: \"My First CVE - CVE-2026-23275 - io uring resize and taskrun race condition\"](https://naup.mygo.tw/2026/03/23/My-First-CVE-CVE-2026-23275/) [article] [CVE-2026-23275]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://naup.mygo.tw/2026/03/23/My-First-CVE-CVE-2026-23275/", "raw_path": "/raw/2026-vulnerabilities-other-my-first-cve-cve-2026-23275-io-uring-resize-and-taskrun-race-condition-primary-b6af.txt" } ] } ], "rank": 141 }, { "cve": "CVE-2026-31419", "year": 2026, "name": "Use-After-Free in the Linux Bonding Driver", "named_from_title": false, "name_source_title": "CVE-2026-31419: Use-After-Free in the Linux Bonding Driver", "discussion_count": 1, "resource_count": 1, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "device driver", "kernel_location": "drivers/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "bbf4388162abfab2", "title": "CVE-2026-31419: Use-After-Free in the Linux Bonding Driver", "year": 2026, "authors": [ "Moe Acherir" ], "primary_url": "https://mohandacherir.github.io/Qdiv7/posts/cve-2026-31419/", "summary_zh": "一篇文章讨论了Linux绑定驱动中的使用后释放漏洞，导致权限提升。", "summary_en": "An article that discusses a use-after-free vulnerability in the Linux bonding driver leading to privilege escalation.", "source_markdown": "[2026: \"CVE-2026-31419: Use-After-Free in the Linux Bonding Driver\" by Moe Acherir](https://mohandacherir.github.io/Qdiv7/posts/cve-2026-31419/) [article] [CVE-2026-31419]", "affected_area": "Bonding Driver", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://mohandacherir.github.io/Qdiv7/posts/cve-2026-31419/", "raw_path": "/raw/2026-vulnerabilities-lpe-cve-2026-31419-use-after-free-in-the-linux-bonding-driver-primary-8651c399.txt" } ] } ], "rank": 142 }, { "cve": "CVE-2025-20741", "year": 2025, "name": "kernel alchemy pt. 1: developing exploit primitives with CVE-2025-20741", "named_from_title": false, "name_source_title": "kernel alchemy pt. 1: developing exploit primitives with CVE-2025-20741", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "9e879dc5dd11446f", "title": "kernel alchemy pt. 1: developing exploit primitives with CVE-2025-20741", "year": 2026, "authors": [ "hypr" ], "primary_url": "https://blog.coffinsec.com/0day/2026/04/02/kernel-alchemy-pt1.html", "summary_zh": "这篇文章讨论了与Linux内核中CVE-2025-20741相关的利用原语的开发。", "summary_en": "This article discusses developing exploit primitives related to CVE-2025-20741 in the Linux kernel.", "source_markdown": "[2026: \"kernel alchemy pt. 1: developing exploit primitives with CVE-2025-20741\" by hypr](https://blog.coffinsec.com/0day/2026/04/02/kernel-alchemy-pt1.html) [article] [CVE-2025-20741]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.coffinsec.com/0day/2026/04/02/kernel-alchemy-pt1.html", "raw_path": "/raw/2026-vulnerabilities-lpe-kernel-alchemy-pt-1-developing-exploit-primitives-with-cve-2025-20741-primary-6488f2f.txt" } ] } ], "rank": 143 }, { "cve": "CVE-2025-21666", "year": 2025, "name": "Linux Kernel Some Vsock Vulnerabilities Analysis", "named_from_title": false, "name_source_title": "Linux Kernel Some Vsock Vulnerabilities Analysis", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "e90834b677f90e38", "title": "Linux Kernel Some Vsock Vulnerabilities Analysis", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html", "summary_zh": "本文提供了对Linux内核中多个Vsock漏洞的分析。", "summary_en": "An analysis of several Vsock vulnerabilities in the Linux kernel is provided in this article.", "source_markdown": "[2025: \"Linux Kernel Some Vsock Vulnerabilities Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html) [article] [CVE-2025-21669] [CVE-2025-21670] [CVE-2025-21666]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html", "raw_path": "/raw/2025-vulnerabilities-other-linux-kernel-some-vsock-vulnerabilities-analysis-primary-69a1492d.txt" } ] } ], "rank": 144 }, { "cve": "CVE-2025-21669", "year": 2025, "name": "Linux Kernel Some Vsock Vulnerabilities Analysis", "named_from_title": false, "name_source_title": "Linux Kernel Some Vsock Vulnerabilities Analysis", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "e90834b677f90e38", "title": "Linux Kernel Some Vsock Vulnerabilities Analysis", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html", "summary_zh": "本文提供了对Linux内核中多个Vsock漏洞的分析。", "summary_en": "An analysis of several Vsock vulnerabilities in the Linux kernel is provided in this article.", "source_markdown": "[2025: \"Linux Kernel Some Vsock Vulnerabilities Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html) [article] [CVE-2025-21669] [CVE-2025-21670] [CVE-2025-21666]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html", "raw_path": "/raw/2025-vulnerabilities-other-linux-kernel-some-vsock-vulnerabilities-analysis-primary-69a1492d.txt" } ] } ], "rank": 145 }, { "cve": "CVE-2025-21670", "year": 2025, "name": "Linux Kernel Some Vsock Vulnerabilities Analysis", "named_from_title": false, "name_source_title": "Linux Kernel Some Vsock Vulnerabilities Analysis", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "e90834b677f90e38", "title": "Linux Kernel Some Vsock Vulnerabilities Analysis", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html", "summary_zh": "本文提供了对Linux内核中多个Vsock漏洞的分析。", "summary_en": "An analysis of several Vsock vulnerabilities in the Linux kernel is provided in this article.", "source_markdown": "[2025: \"Linux Kernel Some Vsock Vulnerabilities Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html) [article] [CVE-2025-21669] [CVE-2025-21670] [CVE-2025-21666]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html", "raw_path": "/raw/2025-vulnerabilities-other-linux-kernel-some-vsock-vulnerabilities-analysis-primary-69a1492d.txt" } ] } ], "rank": 146 }, { "cve": "CVE-2025-22056", "year": 2025, "name": "The tragedy of Netfilter Tunnel: CVE-2025-22056", "named_from_title": false, "name_source_title": "The tragedy of Netfilter Tunnel: CVE-2025-22056", "discussion_count": 1, "resource_count": 1, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "20c1b376ec989d44", "title": "The tragedy of Netfilter Tunnel: CVE-2025-22056", "year": 2025, "authors": [], "primary_url": "https://dawnslab.jd.com/CVE-2025-22056/", "summary_zh": "一篇讨论Netfilter Tunnel中的本地特权升级漏洞的文章。", "summary_en": "An article discussing a local privilege escalation vulnerability in the Netfilter Tunnel.", "source_markdown": "[2025: \"The tragedy of Netfilter Tunnel: CVE-2025-22056\"](https://dawnslab.jd.com/CVE-2025-22056/) [article] [CVE-2025-22056]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://dawnslab.jd.com/CVE-2025-22056/", "raw_path": "/raw/2025-vulnerabilities-lpe-the-tragedy-of-netfilter-tunnel-cve-2025-22056-primary-b1f3a703.txt" } ] } ], "rank": 147 }, { "cve": "CVE-2025-37752", "year": 2025, "name": "Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds", "named_from_title": false, "name_source_title": "[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "45ca7f9ff1de735a", "title": "[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds", "year": 2025, "authors": [ "D3vil" ], "primary_url": "https://syst3mfailure.io/two-bytes-of-madness/", "summary_zh": "2025 年 Linux 内核LPE资料：「[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds」（CVE-2025-37752）；URL 类型：article。", "summary_en": "2025 Linux kernel LPE resource \"[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds\" (CVE-2025-37752); URL type: article.", "source_markdown": "[2025: \"[CVE-2025-37752] Two Bytes Of Madness: Pwning The Linux Kernel With A 0x0000 Written 262636 Bytes Out-Of-Bounds\" by D3vil](https://syst3mfailure.io/two-bytes-of-madness/) [article] [CVE-2025-37752]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://syst3mfailure.io/two-bytes-of-madness/", "raw_path": "/raw/2025-vulnerabilities-lpe-cve-2025-37752-two-bytes-of-madness-pwning-the-linux-kernel-with-a-0x0000-written-262.txt" } ] } ], "rank": 148 }, { "cve": "CVE-2025-37756", "year": 2025, "name": "Analysis of CVE-2025-37756, an UAF Vulnerability in Linux KTLS", "named_from_title": false, "name_source_title": "Analysis of CVE-2025-37756, an UAF Vulnerability in Linux KTLS", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "9d2300a06aeb5a9d", "title": "Analysis of CVE-2025-37756, an UAF Vulnerability in Linux KTLS", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/09/03/analysis-of-CVE-2025-37756-an-uaf-vulnerability-in-linux-ktls.html", "summary_zh": "本文分析了Linux KTLS中的使用后释放漏洞。", "summary_en": "An analysis of a use-after-free vulnerability in Linux KTLS is presented in this article.", "source_markdown": "[2025: \"Analysis of CVE-2025-37756, an UAF Vulnerability in Linux KTLS\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/09/03/analysis-of-CVE-2025-37756-an-uaf-vulnerability-in-linux-ktls.html) [article] [CVE-2025-37756]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/09/03/analysis-of-CVE-2025-37756-an-uaf-vulnerability-in-linux-ktls.html", "raw_path": "/raw/2025-vulnerabilities-other-analysis-of-cve-2025-37756-an-uaf-vulnerability-in-linux-ktls-primary-f3b57eb8.txt" } ] } ], "rank": 149 }, { "cve": "CVE-2025-38003", "year": 2025, "name": "Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel", "named_from_title": false, "name_source_title": "Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "5f855ce5ab84addc", "title": "Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel", "year": 2025, "authors": [ "Anderson Nascimento" ], "primary_url": "https://allelesecurity.com/wp-content/uploads/2025/12/Presentation_307.pdf", "summary_zh": "介绍了CAN BCM协议中/proc组件的漏洞。", "summary_en": "Presents vulnerabilities in the /proc component of the CAN BCM protocol.", "source_markdown": "[2025: \"Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel\" by Anderson Nascimento](https://allelesecurity.com/wp-content/uploads/2025/12/Presentation_307.pdf) [slides] [CVE-2023-52922] [CVE-2025-38003] [CVE-2025-38004]", "affected_area": "/proc", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://allelesecurity.com/wp-content/uploads/2025/12/Presentation_307.pdf", "raw_path": "/raw/2025-vulnerabilities-info-leaks-vulnerabilities-in-the-proc-component-of-the-can-bcm-protocol-in-the-linux-ker.txt" } ] } ], "rank": 150 }, { "cve": "CVE-2025-38004", "year": 2025, "name": "Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel", "named_from_title": false, "name_source_title": "Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "5f855ce5ab84addc", "title": "Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel", "year": 2025, "authors": [ "Anderson Nascimento" ], "primary_url": "https://allelesecurity.com/wp-content/uploads/2025/12/Presentation_307.pdf", "summary_zh": "介绍了CAN BCM协议中/proc组件的漏洞。", "summary_en": "Presents vulnerabilities in the /proc component of the CAN BCM protocol.", "source_markdown": "[2025: \"Vulnerabilities in the /proc Component of the CAN BCM Protocol in the Linux kernel\" by Anderson Nascimento](https://allelesecurity.com/wp-content/uploads/2025/12/Presentation_307.pdf) [slides] [CVE-2023-52922] [CVE-2025-38003] [CVE-2025-38004]", "affected_area": "/proc", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://allelesecurity.com/wp-content/uploads/2025/12/Presentation_307.pdf", "raw_path": "/raw/2025-vulnerabilities-info-leaks-vulnerabilities-in-the-proc-component-of-the-can-bcm-protocol-in-the-linux-ker.txt" } ] } ], "rank": 151 }, { "cve": "CVE-2025-38236", "year": 2025, "name": "From Chrome renderer code exec to kernel with MSG_OOB", "named_from_title": false, "name_source_title": "From Chrome renderer code exec to kernel with MSG_OOB", "discussion_count": 1, "resource_count": 1, "component_id": "core-kernel", "component_label": "Core kernel / task lifetime", "component_detail": "core kernel lifetime or task path", "kernel_location": "kernel/ + fs/exec.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "c71595dbef1107bb", "title": "From Chrome renderer code exec to kernel with MSG_OOB", "year": 2025, "authors": [ "Jann Horn" ], "primary_url": "https://googleprojectzero.blogspot.com/2025/08/from-chrome-renderer-code-exec-to-kernel.html", "summary_zh": "本文描述了从Chrome渲染器代码执行到内核访问的漏洞利用。", "summary_en": "This article describes the exploitation of a vulnerability that transitions from Chrome renderer code execution to kernel access.", "source_markdown": "[2025: \"From Chrome renderer code exec to kernel with MSG_OOB\" by Jann Horn](https://googleprojectzero.blogspot.com/2025/08/from-chrome-renderer-code-exec-to-kernel.html) [article] [CVE-2025-38236]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2025/08/from-chrome-renderer-code-exec-to-kernel.html", "raw_path": "/raw/2025-vulnerabilities-lpe-from-chrome-renderer-code-exec-to-kernel-with-msg-oob-primary-c78a0b24.txt" } ] } ], "rank": 152 }, { "cve": "CVE-2025-40040", "year": 2025, "name": "SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "named_from_title": false, "name_source_title": "SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "4ac9aa673fe43f75", "title": "SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "year": 2023, "authors": [], "primary_url": "https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "summary_zh": "一个包含多个CVE（包括CVE-2023-1206）漏洞利用的库。", "summary_en": "A repository containing exploits for multiple CVEs including CVE-2023-1206.", "source_markdown": "https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "raw_path": "/raw/2023-exploits-spiralbl0ck-cve-2023-1206-cve-2025-40040-cve-2024-49882-primary-6f406acf.txt" } ] } ], "rank": 153 }, { "cve": "CVE-2025-40214", "year": 2025, "name": "Unix GC Remastered", "named_from_title": false, "name_source_title": "Unix GC Remastered", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "04d7a1880b826ef2", "title": "Unix GC Remastered", "year": 2026, "authors": [ "Moe Acherir" ], "primary_url": "https://mohandacherir.github.io/Qdiv7/posts/unix_new_gc/", "summary_zh": "Unix GC Remastered在Unix环境中引入了一个新漏洞。", "summary_en": "Unix GC Remastered introduces a new vulnerability in the Unix environment.", "source_markdown": "[2026: \"Unix GC Remastered\" by Moe Acherir](https://mohandacherir.github.io/Qdiv7/posts/unix_new_gc/) [article] [CVE-2025-40214]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://mohandacherir.github.io/Qdiv7/posts/unix_new_gc/", "raw_path": "/raw/2026-vulnerabilities-other-unix-gc-remastered-primary-0b6dfaee.txt" } ] } ], "rank": 154 }, { "cve": "CVE-2024-14027", "year": 2024, "name": "lcfr-eth/CVE-2024-14027_slop", "named_from_title": false, "name_source_title": "lcfr-eth/CVE-2024-14027_slop", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "e5471f697dd40147", "title": "lcfr-eth/CVE-2024-14027_slop", "year": 2024, "authors": [], "primary_url": "https://github.com/lcfr-eth/CVE-2024-14027_slop/", "summary_zh": "一个用于利用CVE-2024-14027的代码库。", "summary_en": "A code repository for exploiting CVE-2024-14027.", "source_markdown": "https://github.com/lcfr-eth/CVE-2024-14027_slop/ [CVE-2024-14027]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/lcfr-eth/CVE-2024-14027_slop/", "raw_path": "/raw/2024-exploits-lcfr-eth-cve-2024-14027-slop-primary-ad915504.txt" } ] } ], "rank": 155 }, { "cve": "CVE-2024-26809", "year": 2024, "name": "OtterRoot", "named_from_title": true, "name_source_title": "OtterRoot: Netfilter Universal Root 1-day", "discussion_count": 1, "resource_count": 1, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "ca9c08a5766bb211", "title": "OtterRoot: Netfilter Universal Root 1-day", "year": 2024, "authors": [ "Pedro Pinto" ], "primary_url": "https://osec.io/blog/2024-11-25-netfilter-universal-root-1-day", "summary_zh": "2024 年 Linux 内核LPE资料：「OtterRoot: Netfilter Universal Root 1-day」（CVE-2024-26809）；URL 类型：article。", "summary_en": "2024 Linux kernel LPE resource \"OtterRoot: Netfilter Universal Root 1-day\" (CVE-2024-26809); URL type: article.", "source_markdown": "[2024: \"OtterRoot: Netfilter Universal Root 1-day\" by Pedro Pinto](https://osec.io/blog/2024-11-25-netfilter-universal-root-1-day) [article] [CVE-2024-26809]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://osec.io/blog/2024-11-25-netfilter-universal-root-1-day", "raw_path": "/raw/2024-vulnerabilities-lpe-otterroot-netfilter-universal-root-1-day-primary-ab6e98c3.txt" } ] } ], "rank": 156 }, { "cve": "CVE-2024-26921", "year": 2024, "name": "Some Casual Notes for CVE-2024-26921", "named_from_title": false, "name_source_title": "Some Casual Notes for CVE-2024-26921", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "8d177fc204a8e27b", "title": "Some Casual Notes for CVE-2024-26921", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/01/04/some-casual-notes-for-cve-2024-26921.html", "summary_zh": "随笔讨论了Linux内核中CVE-2024-26921的影响。", "summary_en": "Casual notes discuss the implications of CVE-2024-26921 in the Linux kernel.", "source_markdown": "[2025: \"Some Casual Notes for CVE-2024-26921\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/01/04/some-casual-notes-for-cve-2024-26921.html) [article] [CVE-2024-26921]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/01/04/some-casual-notes-for-cve-2024-26921.html", "raw_path": "/raw/2025-vulnerabilities-other-some-casual-notes-for-cve-2024-26921-primary-397bb66a.txt" } ] } ], "rank": 157 }, { "cve": "CVE-2024-26926", "year": 2024, "name": "Analysis", "named_from_title": false, "name_source_title": "CVE-2024-26926 Analysis", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "fca477000983e76f", "title": "CVE-2024-26926 Analysis", "year": 2024, "authors": [ "Maher Azzouzi" ], "primary_url": "https://github.com/MaherAzzouzi/LinuxKernel-nday/blob/main/CVE-2024-26926/CVE_2024_26926_Analysis.pdf", "summary_zh": "对CVE-2024-26926的分析，详细说明其影响和含义。", "summary_en": "An analysis of CVE-2024-26926, detailing its impact and implications.", "source_markdown": "[2024: \"CVE-2024-26926 Analysis\" by Maher Azzouzi](https://github.com/MaherAzzouzi/LinuxKernel-nday/blob/main/CVE-2024-26926/CVE_2024_26926_Analysis.pdf) [article] [CVE-2024-26926]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/MaherAzzouzi/LinuxKernel-nday/blob/main/CVE-2024-26926/CVE_2024_26926_Analysis.pdf", "raw_path": "/raw/2024-vulnerabilities-other-cve-2024-26926-analysis-primary-3f2bce66.txt" } ] } ], "rank": 158 }, { "cve": "CVE-2024-27394", "year": 2024, "name": "Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394", "named_from_title": false, "name_source_title": "Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "21c4069d40512004", "title": "Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)", "year": 2024, "authors": [], "primary_url": "https://blog.theori.io/deep-dive-into-rcu-race-condition-analysis-of-tcp-ao-uaf-cve-2024-27394-f40508b84c42", "summary_zh": "本文深入分析了导致TCP-AO中使用后释放漏洞的竞争条件。", "summary_en": "This article provides an in-depth analysis of a race condition leading to a use-after-free vulnerability in TCP-AO.", "source_markdown": "[2024: \"Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)\"](https://blog.theori.io/deep-dive-into-rcu-race-condition-analysis-of-tcp-ao-uaf-cve-2024-27394-f40508b84c42) [article] [CVE-2024-27394]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.theori.io/deep-dive-into-rcu-race-condition-analysis-of-tcp-ao-uaf-cve-2024-27394-f40508b84c42", "raw_path": "/raw/2024-vulnerabilities-other-deep-dive-into-rcu-race-condition-analysis-of-tcp-ao-uaf-cve-2024-27394-primary-68f.txt" } ] } ], "rank": 159 }, { "cve": "CVE-2024-35880", "year": 2024, "name": "A Series of io_uring pbuf Vulnerabilities", "named_from_title": false, "name_source_title": "A Series of io_uring pbuf Vulnerabilities", "discussion_count": 1, "resource_count": 1, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "20a2fbef2af3dd9f", "title": "A Series of io_uring pbuf Vulnerabilities", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/03/02/a-series-of-io_uring-pbuf-vulnerabilities.html", "summary_zh": "本文讨论了与Linux内核io_uring pbuf相关的一系列漏洞。", "summary_en": "This article discusses a series of vulnerabilities related to io_uring pbuf in the Linux kernel.", "source_markdown": "[2025: \"A Series of io_uring pbuf Vulnerabilities\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/03/02/a-series-of-io_uring-pbuf-vulnerabilities.html) [article] [CVE-2024-0582] [CVE-2024-35880] [CVE-UNKNOWN]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/03/02/a-series-of-io_uring-pbuf-vulnerabilities.html", "raw_path": "/raw/2025-vulnerabilities-other-a-series-of-io-uring-pbuf-vulnerabilities-primary-50c4d67e.txt" } ] } ], "rank": 160 }, { "cve": "CVE-2024-36016", "year": 2024, "name": "Simply Analyzing Two N_GSM Vulnerabilities", "named_from_title": false, "name_source_title": "Simply Analyzing Two N_GSM Vulnerabilities", "discussion_count": 1, "resource_count": 1, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "device driver", "kernel_location": "drivers/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "5cfa15eaec0d03cc", "title": "Simply Analyzing Two N_GSM Vulnerabilities", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/03/31/simply-analyzing-two-n_gsm-vulnerabilities.html", "summary_zh": "本文分析了Linux内核N_GSM子系统中的两个漏洞。", "summary_en": "This article analyzes two vulnerabilities in the N_GSM subsystem of the Linux kernel.", "source_markdown": "[2025: \"Simply Analyzing Two N_GSM Vulnerabilities\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/03/31/simply-analyzing-two-n_gsm-vulnerabilities.html) [article] [CVE-2024-36016]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/03/31/simply-analyzing-two-n_gsm-vulnerabilities.html", "raw_path": "/raw/2025-vulnerabilities-other-simply-analyzing-two-n-gsm-vulnerabilities-primary-12bfe240.txt" } ] } ], "rank": 161 }, { "cve": "CVE-2024-36886", "year": 2024, "name": "ZDI-24-821: A Remote UAF in The Kernel's net/tipc", "named_from_title": false, "name_source_title": "ZDI-24-821: A Remote UAF in The Kernel's net/tipc", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "0c1e5c315a892bfd", "title": "ZDI-24-821: A Remote UAF in The Kernel's net/tipc", "year": 2024, "authors": [ "Sam Page" ], "primary_url": "https://sam4k.com/zdi-24-821-a-remote-use-after-free-in-the-kernels-net-tipc/", "summary_zh": "ZDI-24-821强调了Linux内核net/tipc子系统中的远程使用后释放漏洞。", "summary_en": "ZDI-24-821 highlights a remote use-after-free vulnerability in the Linux kernel's net/tipc subsystem.", "source_markdown": "[2024: \"ZDI-24-821: A Remote UAF in The Kernel's net/tipc\" by Sam Page](https://sam4k.com/zdi-24-821-a-remote-use-after-free-in-the-kernels-net-tipc/) [article] [ZDI-24-821] [CVE-2024-36886]", "affected_area": "net/tipc", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://sam4k.com/zdi-24-821-a-remote-use-after-free-in-the-kernels-net-tipc/", "raw_path": "/raw/2024-vulnerabilities-other-zdi-24-821-a-remote-uaf-in-the-kernel-s-net-tipc-primary-875f9a24.txt" } ] } ], "rank": 162 }, { "cve": "CVE-2024-41003", "year": 2024, "name": "Vulnerability in the eBPF verifier register limit tracking", "named_from_title": false, "name_source_title": "Vulnerability in the eBPF verifier register limit tracking", "discussion_count": 1, "resource_count": 1, "component_id": "ebpf", "component_label": "eBPF / verifier", "component_detail": "eBPF/verifier", "kernel_location": "kernel/bpf/ + net/core/filter.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "d53cdd768f905edc", "title": "Vulnerability in the eBPF verifier register limit tracking", "year": 2024, "authors": [ "Juan Jose Lopez Jaimez" ], "primary_url": "https://github.com/google/security-research/security/advisories/GHSA-hfqc-63c7-rj9f", "summary_zh": "与eBPF验证器寄存器限制跟踪中的漏洞相关的代码。", "summary_en": "Code related to a vulnerability in the eBPF verifier register limit tracking.", "source_markdown": "[2024: \"Vulnerability in the eBPF verifier register limit tracking\" by Juan Jose Lopez Jaimez](https://github.com/google/security-research/security/advisories/GHSA-hfqc-63c7-rj9f) [CVE-2024-41003]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/google/security-research/security/advisories/GHSA-hfqc-63c7-rj9f", "raw_path": "/raw/2024-vulnerabilities-lpe-vulnerability-in-the-ebpf-verifier-register-limit-tracking-primary-32390534.txt" } ] } ], "rank": 163 }, { "cve": "CVE-2024-43882", "year": 2024, "name": "Linux Kernel: TOCTOU in Exec System", "named_from_title": false, "name_source_title": "Linux Kernel: TOCTOU in Exec System", "discussion_count": 1, "resource_count": 1, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem, VFS, or storage", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "e17fe7add5a3dbf3", "title": "Linux Kernel: TOCTOU in Exec System", "year": 2024, "authors": [ "Marco Vanotti" ], "primary_url": "https://github.com/google/security-research/security/advisories/GHSA-c45w-xwww-rfgg", "summary_zh": "本文讨论了Linux内核exec系统中的TOCTOU漏洞。", "summary_en": "This article discusses a TOCTOU vulnerability in the Linux kernel's exec system.", "source_markdown": "[2024: \"Linux Kernel: TOCTOU in Exec System\" by Marco Vanotti](https://github.com/google/security-research/security/advisories/GHSA-c45w-xwww-rfgg) [article] [CVE-2024-43882]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/google/security-research/security/advisories/GHSA-c45w-xwww-rfgg", "raw_path": "/raw/2024-vulnerabilities-other-linux-kernel-toctou-in-exec-system-primary-dc10aa82.txt" } ] } ], "rank": 164 }, { "cve": "CVE-2024-46713", "year": 2024, "name": "A Quick Note for Perf CVE-2024-46713", "named_from_title": false, "name_source_title": "A Quick Note for Perf CVE-2024-46713", "discussion_count": 1, "resource_count": 1, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "device driver", "kernel_location": "drivers/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "4ad946079f1997e2", "title": "A Quick Note for Perf CVE-2024-46713", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/11/15/a-quick-note-for-perf-cve-2024-46713.html", "summary_zh": "简要说明了Linux内核中Perf漏洞CVE-2024-46713。", "summary_en": "A brief note discusses the Perf vulnerability CVE-2024-46713 in the Linux kernel.", "source_markdown": "[2024: \"A Quick Note for Perf CVE-2024-46713\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/11/15/a-quick-note-for-perf-cve-2024-46713.html) [article] [CVE-2024-46713]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/11/15/a-quick-note-for-perf-cve-2024-46713.html", "raw_path": "/raw/2024-vulnerabilities-other-a-quick-note-for-perf-cve-2024-46713-primary-260bd6a1.txt" } ] } ], "rank": 165 }, { "cve": "CVE-2024-47711", "year": 2024, "name": "Assessing Claude Mythos Preview's cybersecurity capabilities", "named_from_title": false, "name_source_title": "Assessing Claude Mythos Preview's cybersecurity capabilities", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "b6db7b87c60242c8", "title": "Assessing Claude Mythos Preview's cybersecurity capabilities", "year": 2026, "authors": [], "primary_url": "https://red.anthropic.com/2026/mythos-preview/", "summary_zh": "一篇文章评估Claude Mythos Preview的网络安全能力，强调潜在漏洞。", "summary_en": "An article assessing the cybersecurity capabilities of Claude Mythos Preview, highlighting potential vulnerabilities.", "source_markdown": "[2026: \"Assessing Claude Mythos Preview's cybersecurity capabilities\"](https://red.anthropic.com/2026/mythos-preview/) [article] [CVE-2024-47711]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://red.anthropic.com/2026/mythos-preview/", "raw_path": "/raw/2026-vulnerabilities-lpe-assessing-claude-mythos-preview-s-cybersecurity-capabilities-primary-b4a7c378.txt" } ] } ], "rank": 166 }, { "cve": "CVE-2024-49882", "year": 2024, "name": "SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "named_from_title": false, "name_source_title": "SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "4ac9aa673fe43f75", "title": "SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "year": 2023, "authors": [], "primary_url": "https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "summary_zh": "一个包含多个CVE（包括CVE-2023-1206）漏洞利用的库。", "summary_en": "A repository containing exploits for multiple CVEs including CVE-2023-1206.", "source_markdown": "https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "raw_path": "/raw/2023-exploits-spiralbl0ck-cve-2023-1206-cve-2025-40040-cve-2024-49882-primary-6f406acf.txt" } ] } ], "rank": 167 }, { "cve": "CVE-2024-56614", "year": 2024, "name": "Linux Kernel: Integer Overflow in eBPF XSK map_delete_elem Leads to Out-of-Bounds", "named_from_title": false, "name_source_title": "Linux Kernel: Integer Overflow in eBPF XSK map_delete_elem Leads to Out-of-Bounds", "discussion_count": 1, "resource_count": 1, "component_id": "ebpf", "component_label": "eBPF / verifier", "component_detail": "eBPF/verifier", "kernel_location": "kernel/bpf/ + net/core/filter.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "b58be4807b89dee6", "title": "Linux Kernel: Integer Overflow in eBPF XSK map_delete_elem Leads to Out-of-Bounds", "year": 2025, "authors": [ "Jordy Zomer" ], "primary_url": "https://github.com/google/security-research/security/advisories/GHSA-cqc2-6j63-6qrx", "summary_zh": "Linux内核中eBPF的XSK map_delete_elem中的整数溢出导致越界访问。", "summary_en": "An integer overflow vulnerability in eBPF's XSK map_delete_elem leads to out-of-bounds access in the Linux kernel.", "source_markdown": "[2025: \"Linux Kernel: Integer Overflow in eBPF XSK map_delete_elem Leads to Out-of-Bounds\" by Jordy Zomer](https://github.com/google/security-research/security/advisories/GHSA-cqc2-6j63-6qrx) [article] [CVE-2024-56614]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/google/security-research/security/advisories/GHSA-cqc2-6j63-6qrx", "raw_path": "/raw/2025-vulnerabilities-other-linux-kernel-integer-overflow-in-ebpf-xsk-map-delete-elem-leads-to-out-of-bounds-pr.txt" } ] } ], "rank": 168 }, { "cve": "CVE-2024-56615", "year": 2024, "name": "Integer Overflow in eBPF DEVMAP map_delete_elem Leads to Out-of-Bounds", "named_from_title": false, "name_source_title": "Integer Overflow in eBPF DEVMAP map_delete_elem Leads to Out-of-Bounds", "discussion_count": 1, "resource_count": 1, "component_id": "ebpf", "component_label": "eBPF / verifier", "component_detail": "eBPF/verifier", "kernel_location": "kernel/bpf/ + net/core/filter.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "cc24b4a76c313b2e", "title": "Integer Overflow in eBPF DEVMAP map_delete_elem Leads to Out-of-Bounds", "year": 2025, "authors": [ "Jordy Zomer" ], "primary_url": "https://github.com/google/security-research/security/advisories/GHSA-fphp-6498-x998", "summary_zh": "Linux内核中eBPF的DEVMAP map_delete_elem中的整数溢出导致越界访问。", "summary_en": "An integer overflow vulnerability in eBPF's DEVMAP map_delete_elem results in out-of-bounds access in the Linux kernel.", "source_markdown": "[2025: \"Integer Overflow in eBPF DEVMAP map_delete_elem Leads to Out-of-Bounds\" by Jordy Zomer](https://github.com/google/security-research/security/advisories/GHSA-fphp-6498-x998) [article] [CVE-2024-56615]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/google/security-research/security/advisories/GHSA-fphp-6498-x998", "raw_path": "/raw/2025-vulnerabilities-other-integer-overflow-in-ebpf-devmap-map-delete-elem-leads-to-out-of-bounds-primary-6820.txt" } ] } ], "rank": 169 }, { "cve": "CVE-2024-56626", "year": 2024, "name": "Linux Kernel: Out of bounds Write in ksmbd_vfs_stream_write", "named_from_title": false, "name_source_title": "Linux Kernel: Out of bounds Write in ksmbd_vfs_stream_write", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "7691e57b43eb88eb", "title": "Linux Kernel: Out of bounds Write in ksmbd_vfs_stream_write", "year": 2025, "authors": [ "Jordy Zomer" ], "primary_url": "https://github.com/google/security-research/security/advisories/GHSA-qmm2-xfcw-4r29", "summary_zh": "在Linux内核的ksmbd_vfs_stream_write函数中发现了越界写漏洞。", "summary_en": "An out-of-bounds write vulnerability was identified in the ksmbd_vfs_stream_write function of the Linux kernel.", "source_markdown": "[2025: \"Linux Kernel: Out of bounds Write in ksmbd_vfs_stream_write\" by Jordy Zomer](https://github.com/google/security-research/security/advisories/GHSA-qmm2-xfcw-4r29) [article] [CVE-2024-56626]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/google/security-research/security/advisories/GHSA-qmm2-xfcw-4r29", "raw_path": "/raw/2025-vulnerabilities-other-linux-kernel-out-of-bounds-write-in-ksmbd-vfs-stream-write-primary-7548e79d.txt" } ] } ], "rank": 170 }, { "cve": "CVE-2024-56627", "year": 2024, "name": "Linux Kernel: Out of bounds Read in ksmbd_vfs_stream_read", "named_from_title": false, "name_source_title": "Linux Kernel: Out of bounds Read in ksmbd_vfs_stream_read", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "7149f318177623f8", "title": "Linux Kernel: Out of bounds Read in ksmbd_vfs_stream_read", "year": 2025, "authors": [ "Jordy Zomer" ], "primary_url": "https://github.com/google/security-research/security/advisories/GHSA-gqrv-6fcf-hvv8", "summary_zh": "在Linux内核的ksmbd_vfs_stream_read函数中发现了越界读漏洞。", "summary_en": "An out-of-bounds read vulnerability was found in the ksmbd_vfs_stream_read function of the Linux kernel.", "source_markdown": "[2025: \"Linux Kernel: Out of bounds Read in ksmbd_vfs_stream_read\" by Jordy Zomer](https://github.com/google/security-research/security/advisories/GHSA-gqrv-6fcf-hvv8) [article] [CVE-2024-56627]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/google/security-research/security/advisories/GHSA-gqrv-6fcf-hvv8", "raw_path": "/raw/2025-vulnerabilities-other-linux-kernel-out-of-bounds-read-in-ksmbd-vfs-stream-read-primary-e548a6c7.txt" } ] } ], "rank": 171 }, { "cve": "CVE-2023-0590", "year": 2023, "name": "Three Linux net/sched 1-day Analysis", "named_from_title": false, "name_source_title": "Three Linux net/sched 1-day Analysis", "discussion_count": 1, "resource_count": 1, "component_id": "net-sched", "component_label": "Network scheduler", "component_detail": "network scheduler", "kernel_location": "net/sched/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "ddabc644bf1348aa", "title": "Three Linux net/sched 1-day Analysis", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/09/05/three-linux-net_sched-1-day-analysis.html", "summary_zh": "讨论了三个Linux net/sched漏洞的为期一天的分析。", "summary_en": "A one-day analysis of three Linux net/sched vulnerabilities is discussed.", "source_markdown": "[2024: \"Three Linux net/sched 1-day Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/09/05/three-linux-net_sched-1-day-analysis.html) [article] [CVE-2024-36974] [CVE-2023-0590]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/09/05/three-linux-net_sched-1-day-analysis.html", "raw_path": "/raw/2024-vulnerabilities-other-three-linux-net-sched-1-day-analysis-primary-e5eae127.txt" } ] } ], "rank": 172 }, { "cve": "CVE-2023-1206", "year": 2023, "name": "SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "named_from_title": false, "name_source_title": "SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "4ac9aa673fe43f75", "title": "SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "year": 2023, "authors": [], "primary_url": "https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "summary_zh": "一个包含多个CVE（包括CVE-2023-1206）漏洞利用的库。", "summary_en": "A repository containing exploits for multiple CVEs including CVE-2023-1206.", "source_markdown": "https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/SpiralBL0CK/CVE-2023-1206-CVE-2025-40040-CVE-2024-49882", "raw_path": "/raw/2023-exploits-spiralbl0ck-cve-2023-1206-cve-2025-40040-cve-2024-49882-primary-6f406acf.txt" } ] } ], "rank": 173 }, { "cve": "CVE-2023-1829", "year": 2023, "name": "Breaking the Code - Exploiting and Examining CVE-2023-1829 in cls_tcindex Classifier Vulnerability", "named_from_title": false, "name_source_title": "Breaking the Code - Exploiting and Examining CVE-2023-1829 in cls_tcindex Classifier Vulnerability", "discussion_count": 1, "resource_count": 1, "component_id": "net-sched", "component_label": "Network scheduler", "component_detail": "network scheduler", "kernel_location": "net/sched/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "2670718aad5b027e", "title": "Breaking the Code - Exploiting and Examining CVE-2023-1829 in cls_tcindex Classifier Vulnerability", "year": 2023, "authors": [ "Vu Thi Lan" ], "primary_url": "https://starlabs.sg/blog/2023/06-breaking-the-code-exploiting-and-examining-cve-2023-1829-in-cls_tcindex-classifier-vulnerability/", "summary_zh": "本文研究了在cls_tcindex分类器中利用CVE-2023-1829的攻击。", "summary_en": "This article examines the exploitation of CVE-2023-1829 in the cls_tcindex classifier.", "source_markdown": "[2023: \"Breaking the Code - Exploiting and Examining CVE-2023-1829 in cls_tcindex Classifier Vulnerability\" by Vu Thi Lan](https://starlabs.sg/blog/2023/06-breaking-the-code-exploiting-and-examining-cve-2023-1829-in-cls_tcindex-classifier-vulnerability/) [article] [CVE-2023-1829]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://starlabs.sg/blog/2023/06-breaking-the-code-exploiting-and-examining-cve-2023-1829-in-cls_tcindex-classifier-vulnerability/", "raw_path": "/raw/2023-vulnerabilities-lpe-breaking-the-code-exploiting-and-examining-cve-2023-1829-in-cls-tcindex-classifier-vu.txt" } ] } ], "rank": 174 }, { "cve": "CVE-2023-2008", "year": 2023, "name": "Analyzing and exploiting a bug in the udmabuf driver", "named_from_title": false, "name_source_title": "CVE-2023-2008 - Analyzing and exploiting a bug in the udmabuf driver", "discussion_count": 1, "resource_count": 1, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "memory management or page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "5a60daa136a27e1d", "title": "CVE-2023-2008 - Analyzing and exploiting a bug in the udmabuf driver", "year": 2023, "authors": [], "primary_url": "https://labs.bluefrostsecurity.de/blog/cve-2023-2008.html", "summary_zh": "本文分析了udmabuf驱动中的CVE-2023-2008漏洞。", "summary_en": "The article analyzes CVE-2023-2008, a bug in the udmabuf driver.", "source_markdown": "[2023: \"CVE-2023-2008 - Analyzing and exploiting a bug in the udmabuf driver\"](https://labs.bluefrostsecurity.de/blog/cve-2023-2008.html) [article] [CVE-2023-2008]", "affected_area": "udmabuf driver", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://labs.bluefrostsecurity.de/blog/cve-2023-2008.html", "raw_path": "/raw/2023-vulnerabilities-lpe-cve-2023-2008-analyzing-and-exploiting-a-bug-in-the-udmabuf-driver-primary-57ef38da.txt" } ] } ], "rank": 175 }, { "cve": "CVE-2023-2156", "year": 2023, "name": "Route of Death", "named_from_title": true, "name_source_title": "Linux IPv6 'Route of Death' 0day", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "e611c2f05a898940", "title": "Linux IPv6 'Route of Death' 0day", "year": 2023, "authors": [ "Max VA" ], "primary_url": "https://www.interruptlabs.co.uk/articles/linux-ipv6-route-of-death", "summary_zh": "本文讨论了Linux IPv6的“死亡路线”漏洞。", "summary_en": "This article discusses the Linux IPv6 'Route of Death' vulnerability.", "source_markdown": "[2023: \"Linux IPv6 'Route of Death' 0day\" by Max VA](https://www.interruptlabs.co.uk/articles/linux-ipv6-route-of-death) [article] [CVE-2023-2156]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.interruptlabs.co.uk/articles/linux-ipv6-route-of-death", "raw_path": "/raw/2023-vulnerabilities-other-linux-ipv6-route-of-death-0day-primary-2ae5ee30.txt" } ] } ], "rank": 176 }, { "cve": "CVE-2023-2163", "year": 2023, "name": "A deep dive into CVE-2023-2163: How we found and fixed an eBPF Linux Kernel Vulnerability", "named_from_title": false, "name_source_title": "A deep dive into CVE-2023-2163: How we found and fixed an eBPF Linux Kernel Vulnerability", "discussion_count": 1, "resource_count": 1, "component_id": "ebpf", "component_label": "eBPF / verifier", "component_detail": "eBPF/verifier", "kernel_location": "kernel/bpf/ + net/core/filter.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "c690a51a62555111", "title": "A deep dive into CVE-2023-2163: How we found and fixed an eBPF Linux Kernel Vulnerability", "year": 2024, "authors": [ "Juan Jose Lopez Jaimez", "Meador Inge" ], "primary_url": "https://bughunters.google.com/blog/6303226026131456/a-deep-dive-into-cve-2023-2163-how-we-found-and-fixed-an-ebpf-linux-kernel-vulnerability", "summary_zh": "一篇深入探讨CVE-2023-2163的文章，这是一个eBPF Linux内核漏洞。", "summary_en": "An article providing a deep dive into CVE-2023-2163, an eBPF Linux Kernel vulnerability.", "source_markdown": "[2024: \"A deep dive into CVE-2023-2163: How we found and fixed an eBPF Linux Kernel Vulnerability\" by Juan Jose Lopez Jaimez and Meador Inge](https://bughunters.google.com/blog/6303226026131456/a-deep-dive-into-cve-2023-2163-how-we-found-and-fixed-an-ebpf-linux-kernel-vulnerability) [article] [CVE-2023-2163]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://bughunters.google.com/blog/6303226026131456/a-deep-dive-into-cve-2023-2163-how-we-found-and-fixed-an-ebpf-linux-kernel-vulnerability", "raw_path": "/raw/2024-vulnerabilities-lpe-a-deep-dive-into-cve-2023-2163-how-we-found-and-fixed-an-ebpf-linux-kernel-vulnerabil.txt" } ] } ], "rank": 177 }, { "cve": "CVE-2023-23586", "year": 2023, "name": "Linux vDSO & VVAR", "named_from_title": false, "name_source_title": "Linux vDSO & VVAR", "discussion_count": 1, "resource_count": 1, "component_id": "architecture", "component_label": "CPU architecture / side channels", "component_detail": "architecture-specific path", "kernel_location": "arch/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "49d00387513164bb", "title": "Linux vDSO & VVAR", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/12/11/linux-vdso-and-vvar.html", "summary_zh": "分析与Linux vDSO和VVAR相关的漏洞。", "summary_en": "Analyzes vulnerabilities related to Linux vDSO and VVAR.", "source_markdown": "[2024: \"Linux vDSO & VVAR\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/12/11/linux-vdso-and-vvar.html) [article] [CVE-2023-23586]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/12/11/linux-vdso-and-vvar.html", "raw_path": "/raw/2024-vulnerabilities-info-leaks-linux-vdso-vvar-primary-3f62ff93.txt" } ] } ], "rank": 178 }, { "cve": "CVE-2023-3338", "year": 2023, "name": "DECPwn", "named_from_title": true, "name_source_title": "TurtleARM/CVE-2023-3338-DECPwn", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "f510a02e1c10a741", "title": "TurtleARM/CVE-2023-3338-DECPwn", "year": 2023, "authors": [], "primary_url": "https://github.com/TurtleARM/CVE-2023-3338-DECPwn", "summary_zh": "CVE-2023-3338是一个可以被远程利用的Linux内核漏洞。", "summary_en": "CVE-2023-3338 is a Linux kernel vulnerability that can be exploited remotely.", "source_markdown": "https://github.com/TurtleARM/CVE-2023-3338-DECPwn", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/TurtleARM/CVE-2023-3338-DECPwn", "raw_path": "/raw/2023-exploits-turtlearm-cve-2023-3338-decpwn-primary-5013fb0c.txt" } ] } ], "rank": 179 }, { "cve": "CVE-2023-3389", "year": 2023, "name": "LinkedPoll", "named_from_title": true, "name_source_title": "CVE-2023-3389 - LinkedPoll", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "66da686d8a31dc65", "title": "CVE-2023-3389 - LinkedPoll", "year": 2023, "authors": [ "Querijn Voet" ], "primary_url": "https://qyn.app/posts/CVE-2023-3389/", "summary_zh": "本文分析了CVE-2023-3389，一个本地权限提升漏洞。", "summary_en": "This article analyzes CVE-2023-3389, a local privilege escalation vulnerability.", "source_markdown": "[2023: \"CVE-2023-3389 - LinkedPoll\" by Querijn Voet](https://qyn.app/posts/CVE-2023-3389/) [article] [CVE-2023-3389]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://qyn.app/posts/CVE-2023-3389/", "raw_path": "/raw/2023-vulnerabilities-lpe-cve-2023-3389-linkedpoll-primary-b75d9000.txt" } ] } ], "rank": 180 }, { "cve": "CVE-2023-4273", "year": 2023, "name": "a vulnerability in the Linux exFAT driver", "named_from_title": false, "name_source_title": "CVE-2023-4273: a vulnerability in the Linux exFAT driver", "discussion_count": 1, "resource_count": 1, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem, VFS, or storage", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "7aef6cfdbc69d6fa", "title": "CVE-2023-4273: a vulnerability in the Linux exFAT driver", "year": 2023, "authors": [ "Maxim Suhanov" ], "primary_url": "https://dfir.ru/2023/08/23/cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver/", "summary_zh": "CVE-2023-4273强调了Linux exFAT驱动程序中的漏洞。", "summary_en": "CVE-2023-4273 highlights a vulnerability in the Linux exFAT driver.", "source_markdown": "[2023: \"CVE-2023-4273: a vulnerability in the Linux exFAT driver\" by Maxim Suhanov](https://dfir.ru/2023/08/23/cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver/) [article] [CVE-2023-4273]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://dfir.ru/2023/08/23/cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver/", "raw_path": "/raw/2023-vulnerabilities-other-cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver-primary-2d449e70.txt" } ] } ], "rank": 181 }, { "cve": "CVE-2023-4611", "year": 2023, "name": "A Quick Note On Two mempolicy Vulnerabilities", "named_from_title": false, "name_source_title": "A Quick Note On Two mempolicy Vulnerabilities", "discussion_count": 1, "resource_count": 1, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "memory management or page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "1780608bdc2b2aa1", "title": "A Quick Note On Two mempolicy Vulnerabilities", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/03/30/a-quick-note-on-two-mempolicy-vulnerabilites.html", "summary_zh": "本文简要介绍了与Linux内核内存策略相关的两个漏洞。", "summary_en": "A quick note on two vulnerabilities related to memory policies in the Linux kernel is provided.", "source_markdown": "[2025: \"A Quick Note On Two mempolicy Vulnerabilities\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/03/30/a-quick-note-on-two-mempolicy-vulnerabilites.html) [article] [CVE-2022-49080] [CVE-2023-4611]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/03/30/a-quick-note-on-two-mempolicy-vulnerabilites.html", "raw_path": "/raw/2025-vulnerabilities-other-a-quick-note-on-two-mempolicy-vulnerabilities-primary-84bd8399.txt" } ] } ], "rank": 182 }, { "cve": "CVE-2023-5717", "year": 2023, "name": "Linux Kernel Perf CVE-2023-5717 Quick Analysis", "named_from_title": false, "name_source_title": "Linux Kernel Perf CVE-2023-5717 Quick Analysis", "discussion_count": 1, "resource_count": 1, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "device driver", "kernel_location": "drivers/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "2ebeb127116e587d", "title": "Linux Kernel Perf CVE-2023-5717 Quick Analysis", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/11/17/linux-kernel-perf-cve-2023-5717-quick-analysis.html", "summary_zh": "提供了对Linux内核Perf漏洞CVE-2023-5717的快速分析。", "summary_en": "A quick analysis of the Linux kernel Perf vulnerability CVE-2023-5717 is provided.", "source_markdown": "[2024: \"Linux Kernel Perf CVE-2023-5717 Quick Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/11/17/linux-kernel-perf-cve-2023-5717-quick-analysis.html) [article] [CVE-2023-5717]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/11/17/linux-kernel-perf-cve-2023-5717-quick-analysis.html", "raw_path": "/raw/2024-vulnerabilities-other-linux-kernel-perf-cve-2023-5717-quick-analysis-primary-38664ef1.txt" } ] } ], "rank": 183 }, { "cve": "CVE-2023-6200", "year": 2023, "name": "Linux Kernel ICMPv6 & CVE-2023-6200", "named_from_title": false, "name_source_title": "Linux Kernel ICMPv6 & CVE-2023-6200", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "b72334c9c6d0c1b2", "title": "Linux Kernel ICMPv6 & CVE-2023-6200", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/12/04/linux-kernel-icmpv6-and-cve-2023-6200.html", "summary_zh": "对Linux内核的ICMPv6漏洞CVE-2023-6200进行了分析。", "summary_en": "An analysis of the Linux kernel's ICMPv6 vulnerability CVE-2023-6200 is presented.", "source_markdown": "[2024: \"Linux Kernel ICMPv6 & CVE-2023-6200\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/12/04/linux-kernel-icmpv6-and-cve-2023-6200.html) [article] [CVE-2023-6200]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/12/04/linux-kernel-icmpv6-and-cve-2023-6200.html", "raw_path": "/raw/2024-vulnerabilities-other-linux-kernel-icmpv6-cve-2023-6200-primary-c6974eaf.txt" } ] } ], "rank": 184 }, { "cve": "CVE-2023-6546", "year": 2023, "name": "Linux Kernel GSM Multiplexing Race Condition Local Privilege Escalation Vulnerability (CVE-2023-6546", "named_from_title": false, "name_source_title": "Linux Kernel GSM Multiplexing Race Condition Local Privilege Escalation Vulnerability (CVE-2023-6546)", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "8b57eed942620d9a", "title": "Linux Kernel GSM Multiplexing Race Condition Local Privilege Escalation Vulnerability (CVE-2023-6546)", "year": 2023, "authors": [ "Nassim Asrir" ], "primary_url": "https://github.com/Nassim-Asrir/ZDI-24-020/", "summary_zh": "关于与GSM复用相关的Linux内核中的本地特权升级漏洞的报告。", "summary_en": "A report on a local privilege escalation vulnerability in the Linux kernel related to GSM multiplexing.", "source_markdown": "[2023: \"Linux Kernel GSM Multiplexing Race Condition Local Privilege Escalation Vulnerability (CVE-2023-6546)\" by Nassim Asrir](https://github.com/Nassim-Asrir/ZDI-24-020/) [CVE-2023-6546]", "affected_area": "kernel", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/Nassim-Asrir/ZDI-24-020/", "raw_path": "/raw/2023-vulnerabilities-lpe-linux-kernel-gsm-multiplexing-race-condition-local-privilege-escalation-vulnerability.txt" } ] } ], "rank": 185 }, { "cve": "CVE-2023-6931", "year": 2023, "name": "Linux Kernel Perf CVE-2023-6931 Analysis", "named_from_title": false, "name_source_title": "Linux Kernel Perf CVE-2023-6931 Analysis", "discussion_count": 1, "resource_count": 1, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "device driver", "kernel_location": "drivers/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "f55d1df3c7151792", "title": "Linux Kernel Perf CVE-2023-6931 Analysis", "year": 2024, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2024/11/14/linux-kernel-perf-cve-2023-6931-analysis.html", "summary_zh": "分享了对Linux内核Perf漏洞CVE-2023-6931的分析。", "summary_en": "An analysis of the Linux kernel Perf vulnerability CVE-2023-6931 is shared.", "source_markdown": "[2024: \"Linux Kernel Perf CVE-2023-6931 Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2024/11/14/linux-kernel-perf-cve-2023-6931-analysis.html) [article] [CVE-2023-6931]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2024/11/14/linux-kernel-perf-cve-2023-6931-analysis.html", "raw_path": "/raw/2024-vulnerabilities-other-linux-kernel-perf-cve-2023-6931-analysis-primary-38f044f2.txt" } ] } ], "rank": 186 }, { "cve": "CVE-2023-6932", "year": 2023, "name": "Two Network-related vunlnerabilities Analysis", "named_from_title": false, "name_source_title": "Two Network-related vunlnerabilities Analysis", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "37f03983d31270a1", "title": "Two Network-related vunlnerabilities Analysis", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/01/08/two-network-related-vulnerabilities-analysis.html", "summary_zh": "本文提供了对Linux内核中两个网络相关漏洞的分析。", "summary_en": "An analysis of two network-related vulnerabilities in the Linux kernel is provided in this article.", "source_markdown": "[2025: \"Two Network-related vunlnerabilities Analysis\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/01/08/two-network-related-vulnerabilities-analysis.html) [article] [CVE-2023-6932] [CVE-2023-0461]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/01/08/two-network-related-vulnerabilities-analysis.html", "raw_path": "/raw/2025-vulnerabilities-other-two-network-related-vunlnerabilities-analysis-primary-7c835ca0.txt" } ] } ], "rank": 187 }, { "cve": "CVE-2022-1016", "year": 2022, "name": "How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables", "named_from_title": false, "name_source_title": "How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables", "discussion_count": 1, "resource_count": 1, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "35498a870f86c341", "title": "How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables", "year": 2022, "authors": [ "David Bouman" ], "primary_url": "https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/", "summary_zh": "对nf_tables中两个新Linux漏洞的分析揭示了潜在的本地权限提升风险。", "summary_en": "An analysis of two new Linux vulnerabilities in nf_tables reveals potential local privilege escalation risks.", "source_markdown": "[2022: \"How The Tables Have Turned: An analysis of two new Linux vulnerabilities in nf_tables\" by David Bouman](https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/) [CVE-2022-1015] [CVE-2022-1016]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/", "raw_path": "/raw/2022-vulnerabilities-lpe-how-the-tables-have-turned-an-analysis-of-two-new-linux-vulnerabilities-in-nf-tables-.txt" } ] } ], "rank": 188 }, { "cve": "CVE-2022-1786", "year": 2022, "name": "A Journey To The Dawn", "named_from_title": false, "name_source_title": "[CVE-2022-1786] A Journey To The Dawn", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "1a0381869bad47cd", "title": "[CVE-2022-1786] A Journey To The Dawn", "year": 2022, "authors": [], "primary_url": "https://blog.kylebot.net/2022/10/16/CVE-2022-1786/", "summary_zh": "对CVE-2022-1786及其对权限提升影响的探讨。", "summary_en": "An exploration of CVE-2022-1786 and its implications for privilege escalation.", "source_markdown": "[2022: \"[CVE-2022-1786] A Journey To The Dawn\"](https://blog.kylebot.net/2022/10/16/CVE-2022-1786/) [article] [CVE-2022-1786]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.kylebot.net/2022/10/16/CVE-2022-1786/", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-1786-a-journey-to-the-dawn-primary-f4a85d31.txt" } ] } ], "rank": 189 }, { "cve": "CVE-2022-1972", "year": 2022, "name": "Yet another bug into Netfilter", "named_from_title": false, "name_source_title": "Yet another bug into Netfilter", "discussion_count": 1, "resource_count": 1, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "82df40727f3a1066", "title": "Yet another bug into Netfilter", "year": 2022, "authors": [ "Arthur Mongodin" ], "primary_url": "https://www.randorisec.fr/yet-another-bug-netfilter/", "summary_zh": "报告了Linux内核中Netfilter子系统的一个漏洞。", "summary_en": "Reports a bug in the Netfilter subsystem of the Linux kernel.", "source_markdown": "[2022: \"Yet another bug into Netfilter\" by Arthur Mongodin](https://www.randorisec.fr/yet-another-bug-netfilter/) [article] [CVE-2022-1972]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.randorisec.fr/yet-another-bug-netfilter/", "raw_path": "/raw/2022-vulnerabilities-info-leaks-yet-another-bug-into-netfilter-primary-b07a609f.txt" } ] } ], "rank": 190 }, { "cve": "CVE-2022-20186", "year": 2022, "name": "Corrupting memory without memory corruption", "named_from_title": false, "name_source_title": "Corrupting memory without memory corruption", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "85278fd2969fe947", "title": "Corrupting memory without memory corruption", "year": 2022, "authors": [ "Man Yue Mo" ], "primary_url": "https://github.blog/2022-07-27-corrupting-memory-without-memory-corruption/", "summary_zh": "本文讨论了无需传统内存损坏的内存损坏技术。", "summary_en": "This article discusses memory corruption techniques without traditional memory corruption.", "source_markdown": "[2022: \"Corrupting memory without memory corruption\" by Man Yue Mo](https://github.blog/2022-07-27-corrupting-memory-without-memory-corruption/) [article] [CVE-2022-20186]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.blog/2022-07-27-corrupting-memory-without-memory-corruption/", "raw_path": "/raw/2022-vulnerabilities-lpe-corrupting-memory-without-memory-corruption-primary-01b55dc6.txt" } ] } ], "rank": 191 }, { "cve": "CVE-2022-2078", "year": 2022, "name": "Exploiting cross table object reference in Linux Netfilter table (NFT) module", "named_from_title": false, "name_source_title": "Exploiting cross table object reference in Linux Netfilter table (NFT) module", "discussion_count": 1, "resource_count": 1, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "30c6280b9d06f522", "title": "Exploiting cross table object reference in Linux Netfilter table (NFT) module", "year": 2022, "authors": [], "primary_url": "https://docs.google.com/presentation/d/1qcPPz9E_X3z5h_E-Cc7Qmy1ppP4hWjFZQCQ5ZCb9hw8/edit?usp=sharing", "summary_zh": "介绍了Linux Netfilter模块中交叉表对象引用的利用技术。", "summary_en": "Exploitation techniques for cross table object references in the Linux Netfilter module are presented.", "source_markdown": "[2022: \"Exploiting cross table object reference in Linux Netfilter table (NFT) module\"](https://docs.google.com/presentation/d/1qcPPz9E_X3z5h_E-Cc7Qmy1ppP4hWjFZQCQ5ZCb9hw8/edit?usp=sharing) [slides] [CVE-2022-2078] [CVE-2022-2586]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://docs.google.com/presentation/d/1qcPPz9E_X3z5h_E-Cc7Qmy1ppP4hWjFZQCQ5ZCb9hw8/edit?usp=sharing", "raw_path": "/raw/2022-vulnerabilities-lpe-exploiting-cross-table-object-reference-in-linux-netfilter-table-nft-module-primary-7.txt" } ] } ], "rank": 192 }, { "cve": "CVE-2022-29582", "year": 2022, "name": "An io_uring vulnerability", "named_from_title": false, "name_source_title": "CVE-2022-29582: An io_uring vulnerability", "discussion_count": 1, "resource_count": 1, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "579fb0eda08cb693", "title": "CVE-2022-29582: An io_uring vulnerability", "year": 2022, "authors": [ "Awarau", "David Bouman" ], "primary_url": "https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/", "summary_zh": "一篇详细介绍Linux内核中io_uring漏洞的文章。", "summary_en": "An article detailing an io_uring vulnerability in the Linux kernel.", "source_markdown": "[2022: \"CVE-2022-29582: An io_uring vulnerability\" by Awarau and David Bouman](https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/) [article] [CVE-2022-29582]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/", "raw_path": "/raw/2022-vulnerabilities-lpe-cve-2022-29582-an-io-uring-vulnerability-primary-1d173d6c.txt" } ] } ], "rank": 193 }, { "cve": "CVE-2022-41218", "year": 2022, "name": "Vulnerability Details for CVE-2022-41218", "named_from_title": false, "name_source_title": "Vulnerability Details for CVE-2022-41218", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "40834d50c33d77ab", "title": "Vulnerability Details for CVE-2022-41218", "year": 2022, "authors": [], "primary_url": "https://github.com/V4bel/CVE-2022-41218", "summary_zh": "本文提供了关于CVE-2022-41218漏洞的详细信息。", "summary_en": "This article provides details on the vulnerability CVE-2022-41218.", "source_markdown": "[2022: \"Vulnerability Details for CVE-2022-41218\"](https://github.com/V4bel/CVE-2022-41218) [article] [CVE-2022-41218]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/V4bel/CVE-2022-41218", "raw_path": "/raw/2022-vulnerabilities-other-vulnerability-details-for-cve-2022-41218-primary-dfbb5995.txt" } ] } ], "rank": 194 }, { "cve": "CVE-2022-42703", "year": 2022, "name": "Exploiting CVE-2022-42703 - Bringing back the stack attack", "named_from_title": false, "name_source_title": "Exploiting CVE-2022-42703 - Bringing back the stack attack", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "9bebbe8a61ad8f9d", "title": "Exploiting CVE-2022-42703 - Bringing back the stack attack", "year": 2022, "authors": [ "Seth Jenkins" ], "primary_url": "https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html", "summary_zh": "本文探讨了CVE-2022-42703的利用，重点关注基于堆栈的攻击。", "summary_en": "This article explores the exploitation of CVE-2022-42703, focusing on stack-based attacks.", "source_markdown": "[2022: \"Exploiting CVE-2022-42703 - Bringing back the stack attack\" by Seth Jenkins](https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html) [article] [CVE-2022-42703]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html", "raw_path": "/raw/2022-vulnerabilities-lpe-exploiting-cve-2022-42703-bringing-back-the-stack-attack-primary-7ab370df.txt" } ] } ], "rank": 195 }, { "cve": "CVE-2022-42895", "year": 2022, "name": "Linux Kernel: Infoleak in Bluetooth L2CAP Handling", "named_from_title": false, "name_source_title": "Linux Kernel: Infoleak in Bluetooth L2CAP Handling", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "a2ca84227707daed", "title": "Linux Kernel: Infoleak in Bluetooth L2CAP Handling", "year": 2022, "authors": [], "primary_url": "https://github.com/google/security-research/security/advisories/GHSA-vccx-8h74-2357", "summary_zh": "该代码资源详细介绍了Linux内核中Bluetooth L2CAP处理的泄露漏洞。", "summary_en": "This code resource details an infoleak vulnerability in Bluetooth L2CAP handling in the Linux kernel.", "source_markdown": "[2022: \"Linux Kernel: Infoleak in Bluetooth L2CAP Handling\"](https://github.com/google/security-research/security/advisories/GHSA-vccx-8h74-2357) [advisory] [CVE-2022-42895]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-vccx-8h74-2357", "raw_path": "/raw/2022-vulnerabilities-other-linux-kernel-infoleak-in-bluetooth-l2cap-handling-primary-30428cd4.txt" } ] } ], "rank": 196 }, { "cve": "CVE-2022-42896", "year": 2022, "name": "Linux Kernel: UAF in Bluetooth L2CAP Handshake", "named_from_title": false, "name_source_title": "Linux Kernel: UAF in Bluetooth L2CAP Handshake", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "1b690d4fe33aa208", "title": "Linux Kernel: UAF in Bluetooth L2CAP Handshake", "year": 2022, "authors": [], "primary_url": "https://github.com/google/security-research/security/advisories/GHSA-pf87-6c9q-jvm4", "summary_zh": "该代码资源讨论了Bluetooth L2CAP握手中的使用后释放漏洞。", "summary_en": "This code resource discusses a use-after-free vulnerability in Bluetooth L2CAP handshake.", "source_markdown": "[2022: \"Linux Kernel: UAF in Bluetooth L2CAP Handshake\"](https://github.com/google/security-research/security/advisories/GHSA-pf87-6c9q-jvm4) [advisory] [CVE-2022-42896]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "advisory", "url": "https://github.com/google/security-research/security/advisories/GHSA-pf87-6c9q-jvm4", "raw_path": "/raw/2022-vulnerabilities-other-linux-kernel-uaf-in-bluetooth-l2cap-handshake-primary-caafce63.txt" } ] } ], "rank": 197 }, { "cve": "CVE-2022-46395", "year": 2022, "name": "Rooting with root cause: finding a variant of a Project Zero bug", "named_from_title": false, "name_source_title": "Rooting with root cause: finding a variant of a Project Zero bug", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "1b47bc8c6c5f69a9", "title": "Rooting with root cause: finding a variant of a Project Zero bug", "year": 2023, "authors": [ "Man Yue Mo" ], "primary_url": "https://github.blog/2023-05-25-rooting-with-root-cause-finding-a-variant-of-a-project-zero-bug/", "summary_zh": "本文讨论了与本地权限提升相关的Project Zero漏洞变种。", "summary_en": "This article discusses a variant of a Project Zero bug related to local privilege escalation.", "source_markdown": "[2023: \"Rooting with root cause: finding a variant of a Project Zero bug\" by Man Yue Mo](https://github.blog/2023-05-25-rooting-with-root-cause-finding-a-variant-of-a-project-zero-bug/) [article] [CVE-2022-46395]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.blog/2023-05-25-rooting-with-root-cause-finding-a-variant-of-a-project-zero-bug/", "raw_path": "/raw/2023-vulnerabilities-lpe-rooting-with-root-cause-finding-a-variant-of-a-project-zero-bug-primary-83ba4117.txt" } ] } ], "rank": 198 }, { "cve": "CVE-2022-49080", "year": 2022, "name": "A Quick Note On Two mempolicy Vulnerabilities", "named_from_title": false, "name_source_title": "A Quick Note On Two mempolicy Vulnerabilities", "discussion_count": 1, "resource_count": 1, "component_id": "memory", "component_label": "Memory / page cache", "component_detail": "memory management or page cache", "kernel_location": "mm/ + fs/pipe.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "1780608bdc2b2aa1", "title": "A Quick Note On Two mempolicy Vulnerabilities", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/03/30/a-quick-note-on-two-mempolicy-vulnerabilites.html", "summary_zh": "本文简要介绍了与Linux内核内存策略相关的两个漏洞。", "summary_en": "A quick note on two vulnerabilities related to memory policies in the Linux kernel is provided.", "source_markdown": "[2025: \"A Quick Note On Two mempolicy Vulnerabilities\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/03/30/a-quick-note-on-two-mempolicy-vulnerabilites.html) [article] [CVE-2022-49080] [CVE-2023-4611]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/03/30/a-quick-note-on-two-mempolicy-vulnerabilites.html", "raw_path": "/raw/2025-vulnerabilities-other-a-quick-note-on-two-mempolicy-vulnerabilities-primary-84bd8399.txt" } ] } ], "rank": 199 }, { "cve": "CVE-2021-1048", "year": 2021, "name": "refcount increment on mid-destruction file", "named_from_title": false, "name_source_title": "CVE-2021-1048: refcount increment on mid-destruction file", "discussion_count": 1, "resource_count": 1, "component_id": "core-kernel", "component_label": "Core kernel / task lifetime", "component_detail": "core kernel lifetime or task path", "kernel_location": "kernel/ + fs/exec.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "2856584762c58225", "title": "CVE-2021-1048: refcount increment on mid-destruction file", "year": 2021, "authors": [ "Jann Horn" ], "primary_url": "https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1048.html", "summary_zh": "检查中销毁文件上的引用计数增加漏洞CVE-2021-1048。", "summary_en": "Examines the refcount increment vulnerability on mid-destruction files, CVE-2021-1048.", "source_markdown": "[2021: \"CVE-2021-1048: refcount increment on mid-destruction file\" by Jann Horn](https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1048.html) [article] [CVE-2021-1048]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-1048.html", "raw_path": "/raw/2021-vulnerabilities-other-cve-2021-1048-refcount-increment-on-mid-destruction-file-primary-2f7c3977.txt" } ] } ], "rank": 200 }, { "cve": "CVE-2021-22555", "year": 2021, "name": "Turning \\x00\\x00 into 10000$", "named_from_title": false, "name_source_title": "CVE-2021-22555: Turning \\x00\\x00 into 10000$", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "bab61318121cb095", "title": "CVE-2021-22555: Turning \\x00\\x00 into 10000$", "year": 2021, "authors": [ "Andy Nguyen" ], "primary_url": "https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html", "summary_zh": "该文章涵盖了CVE-2021-22555及其影响。", "summary_en": "This article covers CVE-2021-22555 and its implications.", "source_markdown": "[2021: \"CVE-2021-22555: Turning \\x00\\x00 into 10000$\" by Andy Nguyen](https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html) [CVE-2021-22555, article]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html", "raw_path": "/raw/2021-vulnerabilities-lpe-cve-2021-22555-turning-x00-x00-into-10000-primary-11ce17b4.txt" } ] } ], "rank": 201 }, { "cve": "CVE-2021-23134", "year": 2021, "name": "Linux kernel Use-After-Free (CVE-2021-23134) PoC", "named_from_title": false, "name_source_title": "Linux kernel Use-After-Free (CVE-2021-23134) PoC", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "a76764c9ac1b982d", "title": "Linux kernel Use-After-Free (CVE-2021-23134) PoC", "year": 2022, "authors": [], "primary_url": "https://web.archive.org/web/20220616193522/https://ruia-ruia.github.io/NFC-UAF/", "summary_zh": "CVE-2021-23134是Linux内核中的使用后释放漏洞。", "summary_en": "CVE-2021-23134 is a use-after-free vulnerability in the Linux kernel.", "source_markdown": "[2022: \"Linux kernel Use-After-Free (CVE-2021-23134) PoC\"](https://web.archive.org/web/20220616193522/https://ruia-ruia.github.io/NFC-UAF/) [article] [CVE-2021-23134]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://web.archive.org/web/20220616193522/https://ruia-ruia.github.io/NFC-UAF/", "raw_path": "/raw/2022-vulnerabilities-lpe-linux-kernel-use-after-free-cve-2021-23134-poc-primary-f578f41a.txt" } ] } ], "rank": 202 }, { "cve": "CVE-2021-26341", "year": 2021, "name": "The AMD Branch (Mis)predictor Part 2: Where No CPU has Gone Before (CVE-2021-26341", "named_from_title": false, "name_source_title": "The AMD Branch (Mis)predictor Part 2: Where No CPU has Gone Before (CVE-2021-26341)", "discussion_count": 1, "resource_count": 1, "component_id": "architecture", "component_label": "CPU architecture / side channels", "component_detail": "architecture-specific path", "kernel_location": "arch/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "44ed48deb4c5d3c7", "title": "The AMD Branch (Mis)predictor Part 2: Where No CPU has Gone Before (CVE-2021-26341)", "year": 2022, "authors": [ "Pawel Wieczorkiewicz" ], "primary_url": "https://grsecurity.net/amd_branch_mispredictor_part_2_where_no_cpu_has_gone_before", "summary_zh": "本文分析了AMD分支预测器漏洞（CVE-2021-26341）及其影响。", "summary_en": "The article analyzes the AMD Branch predictor vulnerability (CVE-2021-26341) and its implications.", "source_markdown": "[2022: \"The AMD Branch (Mis)predictor Part 2: Where No CPU has Gone Before (CVE-2021-26341)\" by Pawel Wieczorkiewicz](https://grsecurity.net/amd_branch_mispredictor_part_2_where_no_cpu_has_gone_before) [article] [Spectre]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://grsecurity.net/amd_branch_mispredictor_part_2_where_no_cpu_has_gone_before", "raw_path": "/raw/2022-vulnerabilities-info-leaks-the-amd-branch-mis-predictor-part-2-where-no-cpu-has-gone-before-cve-2021-2634.txt" } ] } ], "rank": 203 }, { "cve": "CVE-2021-27363", "year": 2021, "name": "New Old Bugs in the Linux Kernel", "named_from_title": false, "name_source_title": "New Old Bugs in the Linux Kernel", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "228c0d38a63c3f08", "title": "New Old Bugs in the Linux Kernel", "year": 2021, "authors": [], "primary_url": "https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html", "summary_zh": "该文章强调了在Linux内核中重新出现的多个旧漏洞。", "summary_en": "The article highlights multiple old vulnerabilities in the Linux kernel that have resurfaced.", "source_markdown": "[2021: \"New Old Bugs in the Linux Kernel\"](https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html) [article] [CVE-2021-27365, CVE-2021-27363, CVE-2021-27364]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html", "raw_path": "/raw/2021-vulnerabilities-lpe-new-old-bugs-in-the-linux-kernel-primary-05773940.txt" } ] } ], "rank": 204 }, { "cve": "CVE-2021-27364", "year": 2021, "name": "New Old Bugs in the Linux Kernel", "named_from_title": false, "name_source_title": "New Old Bugs in the Linux Kernel", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "228c0d38a63c3f08", "title": "New Old Bugs in the Linux Kernel", "year": 2021, "authors": [], "primary_url": "https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html", "summary_zh": "该文章强调了在Linux内核中重新出现的多个旧漏洞。", "summary_en": "The article highlights multiple old vulnerabilities in the Linux kernel that have resurfaced.", "source_markdown": "[2021: \"New Old Bugs in the Linux Kernel\"](https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html) [article] [CVE-2021-27365, CVE-2021-27363, CVE-2021-27364]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html", "raw_path": "/raw/2021-vulnerabilities-lpe-new-old-bugs-in-the-linux-kernel-primary-05773940.txt" } ] } ], "rank": 205 }, { "cve": "CVE-2021-27365", "year": 2021, "name": "New Old Bugs in the Linux Kernel", "named_from_title": false, "name_source_title": "New Old Bugs in the Linux Kernel", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "228c0d38a63c3f08", "title": "New Old Bugs in the Linux Kernel", "year": 2021, "authors": [], "primary_url": "https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html", "summary_zh": "该文章强调了在Linux内核中重新出现的多个旧漏洞。", "summary_en": "The article highlights multiple old vulnerabilities in the Linux kernel that have resurfaced.", "source_markdown": "[2021: \"New Old Bugs in the Linux Kernel\"](https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html) [article] [CVE-2021-27365, CVE-2021-27363, CVE-2021-27364]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html", "raw_path": "/raw/2021-vulnerabilities-lpe-new-old-bugs-in-the-linux-kernel-primary-05773940.txt" } ] } ], "rank": 206 }, { "cve": "CVE-2021-32606", "year": 2021, "name": "CAN ISOTP local privilege escalation", "named_from_title": false, "name_source_title": "CVE-2021-32606: CAN ISOTP local privilege escalation", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "619a665d60e508c9", "title": "CVE-2021-32606: CAN ISOTP local privilege escalation", "year": 2021, "authors": [], "primary_url": "https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-32606/cve-2021-32606.md", "summary_zh": "该文章讨论了CAN ISOTP中的本地权限提升（CVE-2021-32606）。", "summary_en": "The article discusses local privilege escalation in CAN ISOTP (CVE-2021-32606).", "source_markdown": "[2021: \"CVE-2021-32606: CAN ISOTP local privilege escalation\"](https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-32606/cve-2021-32606.md) [article] [CVE-2021-32606]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-32606/cve-2021-32606.md", "raw_path": "/raw/2021-vulnerabilities-lpe-cve-2021-32606-can-isotp-local-privilege-escalation-primary-b5546545.txt" } ] } ], "rank": 207 }, { "cve": "CVE-2021-33909", "year": 2021, "name": "Sequoia", "named_from_title": true, "name_source_title": "Sequoia: A deep root in Linux's filesystem layer (CVE-2021-33909)", "discussion_count": 1, "resource_count": 1, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem path-size handling", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "high", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "57bb04a78278b837", "title": "Sequoia: A deep root in Linux's filesystem layer (CVE-2021-33909)", "year": 2021, "authors": [ "Qualys Research Team" ], "primary_url": "https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt", "summary_zh": "该文章讨论了Linux中的文件系统层漏洞（CVE-2021-33909）。", "summary_en": "The article discusses a filesystem layer vulnerability in Linux (CVE-2021-33909).", "source_markdown": "[2021: \"Sequoia: A deep root in Linux's filesystem layer (CVE-2021-33909)\" by Qualys Research Team](https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt) [article] [CVE-2021-33909]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt", "raw_path": "/raw/2021-vulnerabilities-lpe-sequoia-a-deep-root-in-linux-s-filesystem-layer-cve-2021-33909-primary-e59c9b2b.txt" } ] } ], "rank": 208 }, { "cve": "CVE-2021-34866", "year": 2021, "name": "Writeup", "named_from_title": false, "name_source_title": "CVE-2021-34866 Writeup", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "af48aa3408d19321", "title": "CVE-2021-34866 Writeup", "year": 2021, "authors": [ "HexRabbit" ], "primary_url": "https://blog.hexrabbit.io/2021/11/03/CVE-2021-34866-writeup/", "summary_zh": "该写作涵盖了CVE-2021-34866的详细信息。", "summary_en": "This writeup covers the details of CVE-2021-34866.", "source_markdown": "[2021: \"CVE-2021-34866 Writeup\" by HexRabbit](https://blog.hexrabbit.io/2021/11/03/CVE-2021-34866-writeup/) [article] [CVE-2021-34866]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.hexrabbit.io/2021/11/03/CVE-2021-34866-writeup/", "raw_path": "/raw/2021-vulnerabilities-lpe-cve-2021-34866-writeup-primary-63e36050.txt" } ] } ], "rank": 209 }, { "cve": "CVE-2021-3493", "year": 2021, "name": "SSD Advisory – OverlayFS PE", "named_from_title": false, "name_source_title": "SSD Advisory – OverlayFS PE", "discussion_count": 1, "resource_count": 1, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem, VFS, or storage", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "997e2a5f790d7193", "title": "SSD Advisory – OverlayFS PE", "year": 2021, "authors": [], "primary_url": "https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/", "summary_zh": "CVE-2021-3493是Linux内核中OverlayFS组件的本地权限提升漏洞。", "summary_en": "CVE-2021-3493 is a local privilege escalation vulnerability in the OverlayFS component of the Linux kernel.", "source_markdown": "[2021: \"SSD Advisory – OverlayFS PE\"](https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/) [article] [CVE-2021-3493]", "affected_area": "OverlayFS", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/", "raw_path": "/raw/2021-vulnerabilities-lpe-ssd-advisory-overlayfs-pe-primary-1c6a91fe.txt" } ] } ], "rank": 210 }, { "cve": "CVE-2021-3715", "year": 2021, "name": "Your Trash Kernel Bug, My Precious 0-day", "named_from_title": false, "name_source_title": "Your Trash Kernel Bug, My Precious 0-day", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "5b648d449b79699b", "title": "Your Trash Kernel Bug, My Precious 0-day", "year": 2021, "authors": [ "Zhenpeng Lin" ], "primary_url": "https://zplin.me/talks/BHEU21_trash_kernel_bug.pdf", "summary_zh": "CVE-2021-3715是Linux内核中的本地权限提升漏洞。", "summary_en": "CVE-2021-3715 is a local privilege escalation vulnerability in the Linux kernel.", "source_markdown": "[2021: \"Your Trash Kernel Bug, My Precious 0-day\" by Zhenpeng Lin](https://zplin.me/talks/BHEU21_trash_kernel_bug.pdf) [slides] [CVE-2021-3715]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://zplin.me/talks/BHEU21_trash_kernel_bug.pdf", "raw_path": "/raw/2021-vulnerabilities-lpe-your-trash-kernel-bug-my-precious-0-day-primary-108ac522.txt" } ] } ], "rank": 211 }, { "cve": "CVE-2021-42008", "year": 2021, "name": "Exploiting A 16-Year-Old Vulnerability In The Linux 6pack Driver", "named_from_title": false, "name_source_title": "[CVE-2021-42008] Exploiting A 16-Year-Old Vulnerability In The Linux 6pack Driver", "discussion_count": 1, "resource_count": 1, "component_id": "drivers", "component_label": "Device drivers / TTY / USB / TEE", "component_detail": "device driver", "kernel_location": "drivers/", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "deee9379378326d7", "title": "[CVE-2021-42008] Exploiting A 16-Year-Old Vulnerability In The Linux 6pack Driver", "year": 2021, "authors": [], "primary_url": "https://syst3mfailure.io/sixpack-slab-out-of-bounds", "summary_zh": "CVE-2021-42008是Linux 6pack驱动中的本地权限提升漏洞。", "summary_en": "CVE-2021-42008 is a local privilege escalation vulnerability in the Linux 6pack driver.", "source_markdown": "[2021: \"[CVE-2021-42008] Exploiting A 16-Year-Old Vulnerability In The Linux 6pack Driver\"](https://syst3mfailure.io/sixpack-slab-out-of-bounds) [article] [CVE-2021-42008]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://syst3mfailure.io/sixpack-slab-out-of-bounds", "raw_path": "/raw/2021-vulnerabilities-lpe-cve-2021-42008-exploiting-a-16-year-old-vulnerability-in-the-linux-6pack-driver-prima.txt" } ] } ], "rank": 212 }, { "cve": "CVE-2021-4204", "year": 2021, "name": "tr3ee/CVE-2021-4204", "named_from_title": false, "name_source_title": "tr3ee/CVE-2021-4204", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "dd5b39694f8b6e5d", "title": "tr3ee/CVE-2021-4204", "year": 2021, "authors": [], "primary_url": "https://github.com/tr3ee/CVE-2021-4204", "summary_zh": "CVE-2021-4204是一个可以被远程利用的Linux内核漏洞。", "summary_en": "CVE-2021-4204 is a Linux kernel vulnerability that can be exploited remotely.", "source_markdown": "https://github.com/tr3ee/CVE-2021-4204", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "code", "url": "https://github.com/tr3ee/CVE-2021-4204", "raw_path": "/raw/2021-exploits-tr3ee-cve-2021-4204-primary-7d19cef5.txt" } ] } ], "rank": 213 }, { "cve": "CVE-2021-42327", "year": 2021, "name": "SLUB overflow CVE-2021-42327", "named_from_title": false, "name_source_title": "SLUB overflow CVE-2021-42327", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "470a4622b2daf960", "title": "SLUB overflow CVE-2021-42327", "year": 2021, "authors": [], "primary_url": "https://docfate111.github.io/blog/securityresearch/2021/11/08/SLUBoverflow.html", "summary_zh": "讨论了识别为CVE-2021-42327的SLUB溢出漏洞。", "summary_en": "Discusses the SLUB overflow vulnerability identified as CVE-2021-42327.", "source_markdown": "[2021: \"SLUB overflow CVE-2021-42327\"](https://docfate111.github.io/blog/securityresearch/2021/11/08/SLUBoverflow.html) [article] [CVE-2021-42327]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://docfate111.github.io/blog/securityresearch/2021/11/08/SLUBoverflow.html", "raw_path": "/raw/2021-vulnerabilities-other-slub-overflow-cve-2021-42327-primary-8067eb44.txt" } ] } ], "rank": 214 }, { "cve": "CVE-2021-4440", "year": 2021, "name": "A Linux CNA Case Study", "named_from_title": false, "name_source_title": "CVE-2021-4440: A Linux CNA Case Study", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2024, "article_years": [ 2024 ], "items": [ { "item_id": "ef27f3fc406eb2a0", "title": "CVE-2021-4440: A Linux CNA Case Study", "year": 2024, "authors": [ "Brad Spengler" ], "primary_url": "https://grsecurity.net/cve-2021-4440_linux_cna_case_study", "summary_zh": "本文提供了关于CVE-2021-4440及其在Linux内核中影响的案例研究。", "summary_en": "The article provides a case study on CVE-2021-4440 and its implications in the Linux kernel.", "source_markdown": "[2024: \"CVE-2021-4440: A Linux CNA Case Study\" by Brad Spengler](https://grsecurity.net/cve-2021-4440_linux_cna_case_study) [article]", "affected_area": "", "android_status": "no", "android_confirmed": false, "android_reason": "Not enough evidence that this resource maps to released Android devices.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://grsecurity.net/cve-2021-4440_linux_cna_case_study", "raw_path": "/raw/2024-misc-cve-2021-4440-a-linux-cna-case-study-primary-3176dc6d.txt" } ] } ], "rank": 215 }, { "cve": "CVE-2021-45608", "year": 2021, "name": "NetUSB RCE Flaw in Millions of End User Routers", "named_from_title": false, "name_source_title": "CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "709dd673ff17c37c", "title": "CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers", "year": 2022, "authors": [ "Max Van Amernngen" ], "primary_url": "https://www.sentinelone.com/labs/cve-2021-45608-netusb-rce-flaw-in-millions-of-end-user-routers/", "summary_zh": "分析影响数百万路由器的NetUSB RCE漏洞CVE-2021-45608。", "summary_en": "Analyzes the NetUSB RCE flaw affecting millions of routers, identified as CVE-2021-45608.", "source_markdown": "[2022: \"CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers\" by Max Van Amernngen](https://www.sentinelone.com/labs/cve-2021-45608-netusb-rce-flaw-in-millions-of-end-user-routers/) [article] [CVE-2021-45608]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.sentinelone.com/labs/cve-2021-45608-netusb-rce-flaw-in-millions-of-end-user-routers/", "raw_path": "/raw/2022-vulnerabilities-other-cve-2021-45608-netusb-rce-flaw-in-millions-of-end-user-routers-primary-fc50f2c7.txt" } ] } ], "rank": 216 }, { "cve": "CVE-2020-14356", "year": 2020, "name": "The short story of 1 Linux Kernel Use-After-Free bug and 2 CVEs (CVE-2020-14356 and CVE-2020-25220", "named_from_title": false, "name_source_title": "The short story of 1 Linux Kernel Use-After-Free bug and 2 CVEs (CVE-2020-14356 and CVE-2020-25220)", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2020, "article_years": [ 2020 ], "items": [ { "item_id": "78ac82935e077caa", "title": "The short story of 1 Linux Kernel Use-After-Free bug and 2 CVEs (CVE-2020-14356 and CVE-2020-25220)", "year": 2020, "authors": [ "Adam Zabrocki" ], "primary_url": "http://blog.pi3.com.pl/?p=720", "summary_zh": "讨论与Linux内核使用后释放漏洞相关的两个CVE。", "summary_en": "Discusses two CVEs related to a Linux kernel use-after-free bug.", "source_markdown": "[2020: \"The short story of 1 Linux Kernel Use-After-Free bug and 2 CVEs (CVE-2020-14356 and CVE-2020-25220)\" by Adam Zabrocki](http://blog.pi3.com.pl/?p=720) [article] [CVE-2020-14356, CVE-2020-25220]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "http://blog.pi3.com.pl/?p=720", "raw_path": "/raw/2020-vulnerabilities-other-the-short-story-of-1-linux-kernel-use-after-free-bug-and-2-cves-cve-2020-14356-and-.txt" } ] } ], "rank": 217 }, { "cve": "CVE-2020-14381", "year": 2020, "name": "The curious case of CVE-2020-14381", "named_from_title": false, "name_source_title": "The curious case of CVE-2020-14381", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "3c65ecacb901299f", "title": "The curious case of CVE-2020-14381", "year": 2021, "authors": [], "primary_url": "https://blog.frizn.fr/linux-kernel/cve-2020-14381", "summary_zh": "该文章探讨了CVE-2020-14381的细节，这是一个本地权限提升漏洞。", "summary_en": "The article explores the details surrounding CVE-2020-14381, a local privilege escalation vulnerability.", "source_markdown": "[2021: \"The curious case of CVE-2020-14381\"](https://blog.frizn.fr/linux-kernel/cve-2020-14381) [article] [CVE-2020-14381]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://blog.frizn.fr/linux-kernel/cve-2020-14381", "raw_path": "/raw/2021-vulnerabilities-lpe-the-curious-case-of-cve-2020-14381-primary-4a5e1697.txt" } ] } ], "rank": 218 }, { "cve": "CVE-2020-14386", "year": 2020, "name": "Privilege Escalation Vulnerability in the Linux kernel", "named_from_title": false, "name_source_title": "CVE-2020-14386: Privilege Escalation Vulnerability in the Linux kernel", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2020, "article_years": [ 2020 ], "items": [ { "item_id": "be36a26561aae141", "title": "CVE-2020-14386: Privilege Escalation Vulnerability in the Linux kernel", "year": 2020, "authors": [ "Or Cohen" ], "primary_url": "https://unit42.paloaltonetworks.com/cve-2020-14386/", "summary_zh": "2020 年 Linux 内核LPE资料：「CVE-2020-14386: Privilege Escalation Vulnerability in the Linux kernel」（CVE-2020-14386）；URL 类型：article。", "summary_en": "2020 Linux kernel LPE resource \"CVE-2020-14386: Privilege Escalation Vulnerability in the Linux kernel\" (CVE-2020-14386); URL type: article.", "source_markdown": "[2020: \"CVE-2020-14386: Privilege Escalation Vulnerability in the Linux kernel\" by Or Cohen](https://unit42.paloaltonetworks.com/cve-2020-14386/) [article] [CVE-2020-14386]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://unit42.paloaltonetworks.com/cve-2020-14386/", "raw_path": "/raw/2020-vulnerabilities-lpe-cve-2020-14386-privilege-escalation-vulnerability-in-the-linux-kernel-primary-777a41c.txt" } ] } ], "rank": 219 }, { "cve": "CVE-2020-16119", "year": 2020, "name": "CVE-2020-16119", "named_from_title": false, "name_source_title": "CVE-2020-16119", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2020, "article_years": [ 2020 ], "items": [ { "item_id": "fda4cbf6eb2f77e1", "title": "CVE-2020-16119", "year": 2020, "authors": [], "primary_url": "https://github.com/HadarManor/Public-Vulnerabilities/blob/master/CVE-2020-16119/CVE-2020-16119.md", "summary_zh": "分析Linux内核中的漏洞CVE-2020-16119。", "summary_en": "Analyzes the vulnerability CVE-2020-16119 in the Linux kernel.", "source_markdown": "[2020: \"CVE-2020-16119\"](https://github.com/HadarManor/Public-Vulnerabilities/blob/master/CVE-2020-16119/CVE-2020-16119.md) [article] [CVE-2020-16119]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/HadarManor/Public-Vulnerabilities/blob/master/CVE-2020-16119/CVE-2020-16119.md", "raw_path": "/raw/2020-vulnerabilities-other-cve-2020-16119-primary-13b5088b.txt" } ] } ], "rank": 220 }, { "cve": "CVE-2020-25220", "year": 2020, "name": "The short story of 1 Linux Kernel Use-After-Free bug and 2 CVEs (CVE-2020-14356 and CVE-2020-25220", "named_from_title": false, "name_source_title": "The short story of 1 Linux Kernel Use-After-Free bug and 2 CVEs (CVE-2020-14356 and CVE-2020-25220)", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2020, "article_years": [ 2020 ], "items": [ { "item_id": "78ac82935e077caa", "title": "The short story of 1 Linux Kernel Use-After-Free bug and 2 CVEs (CVE-2020-14356 and CVE-2020-25220)", "year": 2020, "authors": [ "Adam Zabrocki" ], "primary_url": "http://blog.pi3.com.pl/?p=720", "summary_zh": "讨论与Linux内核使用后释放漏洞相关的两个CVE。", "summary_en": "Discusses two CVEs related to a Linux kernel use-after-free bug.", "source_markdown": "[2020: \"The short story of 1 Linux Kernel Use-After-Free bug and 2 CVEs (CVE-2020-14356 and CVE-2020-25220)\" by Adam Zabrocki](http://blog.pi3.com.pl/?p=720) [article] [CVE-2020-14356, CVE-2020-25220]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "http://blog.pi3.com.pl/?p=720", "raw_path": "/raw/2020-vulnerabilities-other-the-short-story-of-1-linux-kernel-use-after-free-bug-and-2-cves-cve-2020-14356-and-.txt" } ] } ], "rank": 221 }, { "cve": "CVE-2020-27194", "year": 2020, "name": "scannells/exploits", "named_from_title": false, "name_source_title": "scannells/exploits", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2020, "article_years": [ 2020 ], "items": [ { "item_id": "8933e6d9c279a076", "title": "scannells/exploits", "year": 2020, "authors": [], "primary_url": "https://github.com/scannells/exploits/tree/master/CVE-2020-27194", "summary_zh": "CVE-2020-27194漏洞的利用代码。", "summary_en": "Exploit code for CVE-2020-27194 vulnerability.", "source_markdown": "https://github.com/scannells/exploits/tree/master/CVE-2020-27194", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "exploit", "url": "https://github.com/scannells/exploits/tree/master/CVE-2020-27194", "raw_path": "/raw/2020-exploits-scannells-exploits-primary-0e1a1e72.txt" } ] } ], "rank": 222 }, { "cve": "CVE-2020-28588", "year": 2020, "name": "Linux Kernel /proc/pid/syscall information disclosure vulnerability", "named_from_title": false, "name_source_title": "Linux Kernel /proc/pid/syscall information disclosure vulnerability", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "c18d3b8ddeb5e040", "title": "Linux Kernel /proc/pid/syscall information disclosure vulnerability", "year": 2021, "authors": [], "primary_url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1211", "summary_zh": "本文讨论了Linux内核中的系统调用信息泄露漏洞（CVE-2020-28588）。", "summary_en": "The article discusses a syscall information disclosure vulnerability in the Linux kernel (CVE-2020-28588).", "source_markdown": "[2021: \"Linux Kernel /proc/pid/syscall information disclosure vulnerability\"](https://talosintelligence.com/vulnerability_reports/TALOS-2020-1211) [article] [CVE-2020-28588]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1211", "raw_path": "/raw/2021-vulnerabilities-info-leaks-linux-kernel-proc-pid-syscall-information-disclosure-vulnerability-primary-d3a.txt" } ] } ], "rank": 223 }, { "cve": "CVE-2020-8835", "year": 2020, "name": "Linux Kernel Privilege Escalation via Improper eBPF Program Verification", "named_from_title": false, "name_source_title": "CVE-2020-8835: Linux Kernel Privilege Escalation via Improper eBPF Program Verification", "discussion_count": 1, "resource_count": 1, "component_id": "ebpf", "component_label": "eBPF / verifier", "component_detail": "eBPF/verifier", "kernel_location": "kernel/bpf/ + net/core/filter.c", "component_confidence": "medium", "android_priority": "review", "android_reason": "属于 Android 内核可能继承的上游 Linux 组件，需结合 Android 配置、版本和厂商回移判断。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2020, "article_years": [ 2020 ], "items": [ { "item_id": "a834355b74f20100", "title": "CVE-2020-8835: Linux Kernel Privilege Escalation via Improper eBPF Program Verification", "year": 2020, "authors": [ "Manfred Paul" ], "primary_url": "https://www.zerodayinitiative.com/blog/2020/4/8/cve-2020-8835-linux-kernel-privilege-escalation-via-improper-ebpf-program-verification", "summary_zh": "2020 年 Linux 内核LPE资料：「CVE-2020-8835: Linux Kernel Privilege Escalation via Improper eBPF Program Verification」（CVE-2020-8835）；URL 类型：article。", "summary_en": "2020 Linux kernel LPE resource \"CVE-2020-8835: Linux Kernel Privilege Escalation via Improper eBPF Program Verification\" (CVE-2020-8835); URL type: article.", "source_markdown": "[2020: \"CVE-2020-8835: Linux Kernel Privilege Escalation via Improper eBPF Program Verification\" by Manfred Paul](https://www.zerodayinitiative.com/blog/2020/4/8/cve-2020-8835-linux-kernel-privilege-escalation-via-improper-ebpf-program-verification) [article] [CVE-2020-8835]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.zerodayinitiative.com/blog/2020/4/8/cve-2020-8835-linux-kernel-privilege-escalation-via-improper-ebpf-program-verification", "raw_path": "/raw/2020-vulnerabilities-lpe-cve-2020-8835-linux-kernel-privilege-escalation-via-improper-ebpf-program-verificatio.txt" } ] } ], "rank": 224 }, { "cve": "CVE-2026-23274", "year": 2026, "name": "From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty", "named_from_title": false, "name_source_title": "From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty", "discussion_count": 1, "resource_count": 1, "component_id": "netfilter", "component_label": "Netfilter / nftables", "component_detail": "Netfilter/nftables", "kernel_location": "net/netfilter/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2026, "article_years": [ 2026 ], "items": [ { "item_id": "144272f69218e89b", "title": "From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty", "year": 2026, "authors": [], "primary_url": "https://nebusec.io/blog/cve-2026-23274-cos/", "summary_zh": "一篇文章详细介绍了Linux内核中Netfilter漏洞的利用，导致获得奖金。", "summary_en": "An article detailing the exploitation of a Netfilter bug in the Linux kernel leading to a bounty reward.", "source_markdown": "[2026: \"From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty\"](https://nebusec.io/blog/cve-2026-23274-cos/) [article] [CVE-2026-23274]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://nebusec.io/blog/cve-2026-23274-cos/", "raw_path": "/raw/2026-vulnerabilities-lpe-from-a-netfilter-bug-to-kernelctf-exploiting-cve-2026-23274-in-the-linux-kernel-and-w.txt" } ] } ], "rank": 225 }, { "cve": "CVE-2025-13350", "year": 2025, "name": "LPE via refcount imbalance in the af_unix of Ubuntu's Kernel", "named_from_title": false, "name_source_title": "LPE via refcount imbalance in the af_unix of Ubuntu's Kernel", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "b23860726859fe4c", "title": "LPE via refcount imbalance in the af_unix of Ubuntu's Kernel", "year": 2025, "authors": [ "kylebot" ], "primary_url": "https://ssd-disclosure.com/lpe-via-refcount-imbalance-in-the-af_unix-of-ubuntus-kernel/", "summary_zh": "本文探讨了由于Ubuntu内核中的引用计数不平衡导致的本地特权升级漏洞。", "summary_en": "This article explores a local privilege escalation vulnerability due to a reference count imbalance in Ubuntu's kernel.", "source_markdown": "[2025: \"LPE via refcount imbalance in the af_unix of Ubuntu's Kernel\" by kylebot](https://ssd-disclosure.com/lpe-via-refcount-imbalance-in-the-af_unix-of-ubuntus-kernel/) [article] [CVE-2025-13350]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://ssd-disclosure.com/lpe-via-refcount-imbalance-in-the-af_unix-of-ubuntus-kernel/", "raw_path": "/raw/2025-vulnerabilities-lpe-lpe-via-refcount-imbalance-in-the-af-unix-of-ubuntu-s-kernel-primary-dd5499d5.txt" } ] } ], "rank": 226 }, { "cve": "CVE-2025-21700", "year": 2025, "name": "From Zero to Emo – My Journey of Many Failures in kernelCTF", "named_from_title": false, "name_source_title": "From Zero to Emo – My Journey of Many Failures in kernelCTF", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "886e3f1320fe9fae", "title": "From Zero to Emo – My Journey of Many Failures in kernelCTF", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/02/21/from-zero-to-emo-my-journey-of-many-failures-in-kernelCTF.html", "summary_zh": "本文讲述了作者在kernelCTF中与各种漏洞的经历。", "summary_en": "This article recounts the author's experiences with various vulnerabilities in kernelCTF.", "source_markdown": "[2025: \"From Zero to Emo – My Journey of Many Failures in kernelCTF\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/02/21/from-zero-to-emo-my-journey-of-many-failures-in-kernelCTF.html) [article] [CVE-2024-56770] [CVE-2025-21703] [CVE-2025-21700]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/02/21/from-zero-to-emo-my-journey-of-many-failures-in-kernelCTF.html", "raw_path": "/raw/2025-vulnerabilities-other-from-zero-to-emo-my-journey-of-many-failures-in-kernelctf-primary-f7bb77b5.txt" } ] } ], "rank": 227 }, { "cve": "CVE-2025-21703", "year": 2025, "name": "From Zero to Emo – My Journey of Many Failures in kernelCTF", "named_from_title": false, "name_source_title": "From Zero to Emo – My Journey of Many Failures in kernelCTF", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "886e3f1320fe9fae", "title": "From Zero to Emo – My Journey of Many Failures in kernelCTF", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/02/21/from-zero-to-emo-my-journey-of-many-failures-in-kernelCTF.html", "summary_zh": "本文讲述了作者在kernelCTF中与各种漏洞的经历。", "summary_en": "This article recounts the author's experiences with various vulnerabilities in kernelCTF.", "source_markdown": "[2025: \"From Zero to Emo – My Journey of Many Failures in kernelCTF\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/02/21/from-zero-to-emo-my-journey-of-many-failures-in-kernelCTF.html) [article] [CVE-2024-56770] [CVE-2025-21703] [CVE-2025-21700]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/02/21/from-zero-to-emo-my-journey-of-many-failures-in-kernelCTF.html", "raw_path": "/raw/2025-vulnerabilities-other-from-zero-to-emo-my-journey-of-many-failures-in-kernelctf-primary-f7bb77b5.txt" } ] } ], "rank": 228 }, { "cve": "CVE-2025-22037", "year": 2025, "name": "ZDI-25-310: Remote NULL Deref in Linux KSMBD", "named_from_title": false, "name_source_title": "ZDI-25-310: Remote NULL Deref in Linux KSMBD", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "487bd31eb01e1815", "title": "ZDI-25-310: Remote NULL Deref in Linux KSMBD", "year": 2025, "authors": [ "Slava Moskvin" ], "primary_url": "https://slavamoskvin.com/zdi-25-310-remote-null-deref-in-linux-ksmbd/", "summary_zh": "本文介绍了Linux KSMBD中的远程NULL解引用漏洞。", "summary_en": "This article covers a remote NULL dereference vulnerability in Linux KSMBD.", "source_markdown": "[2025: \"ZDI-25-310: Remote NULL Deref in Linux KSMBD\" by Slava Moskvin](https://slavamoskvin.com/zdi-25-310-remote-null-deref-in-linux-ksmbd/) [article] [CVE-2025-22037]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://slavamoskvin.com/zdi-25-310-remote-null-deref-in-linux-ksmbd/", "raw_path": "/raw/2025-vulnerabilities-other-zdi-25-310-remote-null-deref-in-linux-ksmbd-primary-845bdeac.txt" } ] } ], "rank": 229 }, { "cve": "CVE-2024-50066", "year": 2024, "name": "Memory-related CVEs Exploited in kernelCTF", "named_from_title": false, "name_source_title": "Memory-related CVEs Exploited in kernelCTF", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": true, "has_exploit_link": true, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "37f846caa4a6b886", "title": "Memory-related CVEs Exploited in kernelCTF", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/01/12/memory-related-cves-exploited-in-kernelctf.html", "summary_zh": "本文讨论了在kernelCTF中利用的与内存相关的CVE。", "summary_en": "This article discusses memory-related CVEs exploited in kernelCTF.", "source_markdown": "[2025: \"Memory-related CVEs Exploited in kernelCTF\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/01/12/memory-related-cves-exploited-in-kernelctf.html) [article] [CVE-2024-50066] [CVE-2023-3269]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": true, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/01/12/memory-related-cves-exploited-in-kernelctf.html", "raw_path": "/raw/2025-vulnerabilities-other-memory-related-cves-exploited-in-kernelctf-primary-af81547c.txt" } ] } ], "rank": 230 }, { "cve": "CVE-2024-56770", "year": 2024, "name": "From Zero to Emo – My Journey of Many Failures in kernelCTF", "named_from_title": false, "name_source_title": "From Zero to Emo – My Journey of Many Failures in kernelCTF", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "886e3f1320fe9fae", "title": "From Zero to Emo – My Journey of Many Failures in kernelCTF", "year": 2025, "authors": [ "Pumpkin Chang" ], "primary_url": "https://u1f383.github.io/linux/2025/02/21/from-zero-to-emo-my-journey-of-many-failures-in-kernelCTF.html", "summary_zh": "本文讲述了作者在kernelCTF中与各种漏洞的经历。", "summary_en": "This article recounts the author's experiences with various vulnerabilities in kernelCTF.", "source_markdown": "[2025: \"From Zero to Emo – My Journey of Many Failures in kernelCTF\" by Pumpkin Chang](https://u1f383.github.io/linux/2025/02/21/from-zero-to-emo-my-journey-of-many-failures-in-kernelCTF.html) [article] [CVE-2024-56770] [CVE-2025-21703] [CVE-2025-21700]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/02/21/from-zero-to-emo-my-journey-of-many-failures-in-kernelCTF.html", "raw_path": "/raw/2025-vulnerabilities-other-from-zero-to-emo-my-journey-of-many-failures-in-kernelctf-primary-f7bb77b5.txt" } ] } ], "rank": 231 }, { "cve": "CVE-2023-2593", "year": 2023, "name": "Abusing Linux In-Kernel SMB Server to Gain Kernel Remote Code Execution", "named_from_title": false, "name_source_title": "Abusing Linux In-Kernel SMB Server to Gain Kernel Remote Code Execution", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "8ca4b9aa1449378b", "title": "Abusing Linux In-Kernel SMB Server to Gain Kernel Remote Code Execution", "year": 2023, "authors": [ "Guillaume Teissier", "Quentin Minster" ], "primary_url": "https://www.youtube.com/watch?v=XT6jLBbzwFM", "summary_zh": "利用Linux内核SMB服务器讨论了如何获得内核远程代码执行。", "summary_en": "Abusing Linux In-Kernel SMB Server discusses gaining kernel remote code execution.", "source_markdown": "[2023: \"Abusing Linux In-Kernel SMB Server to Gain Kernel Remote Code Execution\" by Guillaume Teissier and Quentin Minster](https://www.youtube.com/watch?v=XT6jLBbzwFM) [video] [CVE-2022-47943] [CVE-2023-2593]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=XT6jLBbzwFM", "raw_path": "/raw/2023-vulnerabilities-rce-abusing-linux-in-kernel-smb-server-to-gain-kernel-remote-code-execution-primary-19559.txt" } ] } ], "rank": 232 }, { "cve": "CVE-2023-2612", "year": 2023, "name": "Ubuntu Shiftfs: Unbalanced Unlock Exploitation Attempt", "named_from_title": false, "name_source_title": "Ubuntu Shiftfs: Unbalanced Unlock Exploitation Attempt", "discussion_count": 1, "resource_count": 1, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem, VFS, or storage", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "53c8372b39520f88", "title": "Ubuntu Shiftfs: Unbalanced Unlock Exploitation Attempt", "year": 2023, "authors": [ "Jean-Baptiste Cayrou" ], "primary_url": "https://www.synacktiv.com/sites/default/files/2023-11/ubuntu_shiftfs.pdf", "summary_zh": "本演示讨论了Ubuntu Shiftfs中的不平衡解锁利用尝试。", "summary_en": "This presentation discusses an unbalanced unlock exploitation attempt in Ubuntu's Shiftfs.", "source_markdown": "[2023: \"Ubuntu Shiftfs: Unbalanced Unlock Exploitation Attempt\" by Jean-Baptiste Cayrou](https://www.synacktiv.com/sites/default/files/2023-11/ubuntu_shiftfs.pdf) [slides] [CVE-2023-2612]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "slides", "url": "https://www.synacktiv.com/sites/default/files/2023-11/ubuntu_shiftfs.pdf", "raw_path": "/raw/2023-vulnerabilities-other-ubuntu-shiftfs-unbalanced-unlock-exploitation-attempt-primary-e4066669.txt" } ] } ], "rank": 233 }, { "cve": "CVE-2023-2640", "year": 2023, "name": "GameOver(lay)", "named_from_title": true, "name_source_title": "GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux", "discussion_count": 1, "resource_count": 1, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem, VFS, or storage", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "c80b4e7081aedf3e", "title": "GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux", "year": 2023, "authors": [ "Sagi Tzadik", "Shir Tamari" ], "primary_url": "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability", "summary_zh": "本文讨论了Ubuntu Linux中的多个本地权限提升漏洞。", "summary_en": "The article discusses multiple local privilege escalation vulnerabilities in Ubuntu Linux.", "source_markdown": "[2023: \"GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux\" by Sagi Tzadik and Shir Tamari](https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability) [article] [CVE-2023-2640] [CVE-2023-32629]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability", "raw_path": "/raw/2023-vulnerabilities-lpe-gameover-lay-easy-to-exploit-local-privilege-escalation-vulnerabilities-in-ubuntu-lin.txt" } ] } ], "rank": 234 }, { "cve": "CVE-2023-32629", "year": 2023, "name": "GameOver(lay)", "named_from_title": true, "name_source_title": "GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux", "discussion_count": 1, "resource_count": 1, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem, VFS, or storage", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "c80b4e7081aedf3e", "title": "GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux", "year": 2023, "authors": [ "Sagi Tzadik", "Shir Tamari" ], "primary_url": "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability", "summary_zh": "本文讨论了Ubuntu Linux中的多个本地权限提升漏洞。", "summary_en": "The article discusses multiple local privilege escalation vulnerabilities in Ubuntu Linux.", "source_markdown": "[2023: \"GameOver(lay): Easy-to-exploit local privilege escalation vulnerabilities in Ubuntu Linux\" by Sagi Tzadik and Shir Tamari](https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability) [article] [CVE-2023-2640] [CVE-2023-32629]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability", "raw_path": "/raw/2023-vulnerabilities-lpe-gameover-lay-easy-to-exploit-local-privilege-escalation-vulnerabilities-in-ubuntu-lin.txt" } ] } ], "rank": 235 }, { "cve": "CVE-2023-35001", "year": 2023, "name": "Old bug, shallow bug: Exploiting Ubuntu at Pwn2Own Vancouver 2023", "named_from_title": false, "name_source_title": "Old bug, shallow bug: Exploiting Ubuntu at Pwn2Own Vancouver 2023", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "fcadffa6efd34ec0", "title": "Old bug, shallow bug: Exploiting Ubuntu at Pwn2Own Vancouver 2023", "year": 2023, "authors": [ "Tanguy Dubroca" ], "primary_url": "https://www.synacktiv.com/publications/old-bug-shallow-bug-exploiting-ubuntu-at-pwn2own-vancouver-2023", "summary_zh": "本文讨论了在2023年Pwn2Own温哥华大会上利用Ubuntu中的一个旧漏洞。", "summary_en": "This article discusses the exploitation of an old vulnerability in Ubuntu during Pwn2Own Vancouver 2023.", "source_markdown": "[2023: \"Old bug, shallow bug: Exploiting Ubuntu at Pwn2Own Vancouver 2023\" by Tanguy Dubroca](https://www.synacktiv.com/publications/old-bug-shallow-bug-exploiting-ubuntu-at-pwn2own-vancouver-2023) [article] [CVE-2023-35001]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.synacktiv.com/publications/old-bug-shallow-bug-exploiting-ubuntu-at-pwn2own-vancouver-2023", "raw_path": "/raw/2023-vulnerabilities-lpe-old-bug-shallow-bug-exploiting-ubuntu-at-pwn2own-vancouver-2023-primary-7c8afef1.txt" } ] } ], "rank": 236 }, { "cve": "CVE-2023-4130", "year": 2023, "name": "Eternal-Tux", "named_from_title": true, "name_source_title": "Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "215594620cc83a34", "title": "Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days", "year": 2025, "authors": [ "William Liu" ], "primary_url": "https://www.willsroot.io/2025/09/ksmbd-0-click.html", "summary_zh": "Eternal-Tux讨论了如何制作Linux内核KSMBD 0点击RCE漏洞。", "summary_en": "Eternal-Tux discusses crafting a Linux Kernel KSMBD 0-click RCE exploit.", "source_markdown": "[2025: \"Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days\" by William Liu](https://www.willsroot.io/2025/09/ksmbd-0-click.html) [article] [CVE-2023-52440] [CVE-2023-4130]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.willsroot.io/2025/09/ksmbd-0-click.html", "raw_path": "/raw/2025-vulnerabilities-rce-eternal-tux-crafting-a-linux-kernel-ksmbd-0-click-rce-exploit-from-n-days-primary-a19.txt" } ] } ], "rank": 237 }, { "cve": "CVE-2023-52440", "year": 2023, "name": "Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days", "named_from_title": false, "name_source_title": "Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "215594620cc83a34", "title": "Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days", "year": 2025, "authors": [ "William Liu" ], "primary_url": "https://www.willsroot.io/2025/09/ksmbd-0-click.html", "summary_zh": "Eternal-Tux讨论了如何制作Linux内核KSMBD 0点击RCE漏洞。", "summary_en": "Eternal-Tux discusses crafting a Linux Kernel KSMBD 0-click RCE exploit.", "source_markdown": "[2025: \"Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days\" by William Liu](https://www.willsroot.io/2025/09/ksmbd-0-click.html) [article] [CVE-2023-52440] [CVE-2023-4130]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://www.willsroot.io/2025/09/ksmbd-0-click.html", "raw_path": "/raw/2025-vulnerabilities-rce-eternal-tux-crafting-a-linux-kernel-ksmbd-0-click-rce-exploit-from-n-days-primary-a19.txt" } ] } ], "rank": 238 }, { "cve": "CVE-2023-52926", "year": 2023, "name": "The io_uring Promotion in kernelCTF And Two Vulnerabilities Analysis", "named_from_title": false, "name_source_title": "The io_uring Promotion in kernelCTF And Two Vulnerabilities Analysis", "discussion_count": 1, "resource_count": 1, "component_id": "io-uring", "component_label": "Async I/O / io_uring", "component_detail": "io_uring", "kernel_location": "io_uring/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2025, "article_years": [ 2025 ], "items": [ { "item_id": "48a747aefceabd72", "title": "The io_uring Promotion in kernelCTF And Two Vulnerabilities Analysis", "year": 2025, "authors": [], "primary_url": "https://u1f383.github.io/linux/2025/02/28/the-io_uring-promotion-in-kernelCTF-and-two-vulnerabilities-analysis.html", "summary_zh": "本文分析了与io_uring相关的漏洞在kernelCTF中的情况。", "summary_en": "The article analyzes vulnerabilities related to io_uring in the context of kernelCTF.", "source_markdown": "[2025: The io_uring Promotion in kernelCTF And Two Vulnerabilities Analysis](https://u1f383.github.io/linux/2025/02/28/the-io_uring-promotion-in-kernelCTF-and-two-vulnerabilities-analysis.html) [article] [CVE-UNKNOWN] [CVE-2023-52926]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://u1f383.github.io/linux/2025/02/28/the-io_uring-promotion-in-kernelCTF-and-two-vulnerabilities-analysis.html", "raw_path": "/raw/2025-vulnerabilities-other-the-io-uring-promotion-in-kernelctf-and-two-vulnerabilities-analysis-primary-7f295d.txt" } ] } ], "rank": 239 }, { "cve": "CVE-2022-24354", "year": 2022, "name": "Zenith: Pwn2Own TP-Link AC1750 Smart Wi-Fi Router Remote Code Execution Vulnerability", "named_from_title": false, "name_source_title": "Zenith: Pwn2Own TP-Link AC1750 Smart Wi-Fi Router Remote Code Execution Vulnerability", "discussion_count": 1, "resource_count": 1, "component_id": "other", "component_label": "Other / needs triage", "component_detail": "source title needs manual location review", "kernel_location": "location not resolved from source titles", "component_confidence": "low", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": true, "has_exploit_link": false, "latest_article_year": 2022, "article_years": [ 2022 ], "items": [ { "item_id": "0c51d0266d345ded", "title": "Zenith: Pwn2Own TP-Link AC1750 Smart Wi-Fi Router Remote Code Execution Vulnerability", "year": 2022, "authors": [ "Axel Souchet" ], "primary_url": "https://github.com/0vercl0k/zenith", "summary_zh": "Zenith讨论了TP-Link AC1750路由器中的远程代码执行漏洞。", "summary_en": "Zenith discusses a remote code execution vulnerability in TP-Link AC1750 routers.", "source_markdown": "[2022: \"Zenith: Pwn2Own TP-Link AC1750 Smart Wi-Fi Router Remote Code Execution Vulnerability\" by Axel Souchet](https://github.com/0vercl0k/zenith) [article] [CVE-2022-24354]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": true, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://github.com/0vercl0k/zenith", "raw_path": "/raw/2022-vulnerabilities-rce-zenith-pwn2own-tp-link-ac1750-smart-wi-fi-router-remote-code-execution-vulnerability-.txt" } ] } ], "rank": 240 }, { "cve": "CVE-2022-47943", "year": 2022, "name": "Abusing Linux In-Kernel SMB Server to Gain Kernel Remote Code Execution", "named_from_title": false, "name_source_title": "Abusing Linux In-Kernel SMB Server to Gain Kernel Remote Code Execution", "discussion_count": 1, "resource_count": 1, "component_id": "network", "component_label": "Network protocols / sockets", "component_detail": "network protocol or socket", "kernel_location": "net/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2023, "article_years": [ 2023 ], "items": [ { "item_id": "8ca4b9aa1449378b", "title": "Abusing Linux In-Kernel SMB Server to Gain Kernel Remote Code Execution", "year": 2023, "authors": [ "Guillaume Teissier", "Quentin Minster" ], "primary_url": "https://www.youtube.com/watch?v=XT6jLBbzwFM", "summary_zh": "利用Linux内核SMB服务器讨论了如何获得内核远程代码执行。", "summary_en": "Abusing Linux In-Kernel SMB Server discusses gaining kernel remote code execution.", "source_markdown": "[2023: \"Abusing Linux In-Kernel SMB Server to Gain Kernel Remote Code Execution\" by Guillaume Teissier and Quentin Minster](https://www.youtube.com/watch?v=XT6jLBbzwFM) [video] [CVE-2022-47943] [CVE-2023-2593]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "video", "url": "https://www.youtube.com/watch?v=XT6jLBbzwFM", "raw_path": "/raw/2023-vulnerabilities-rce-abusing-linux-in-kernel-smb-server-to-gain-kernel-remote-code-execution-primary-19559.txt" } ] } ], "rank": 241 }, { "cve": "CVE-2021-29657", "year": 2021, "name": "An EPYC escape: Case-study of a KVM breakout", "named_from_title": false, "name_source_title": "An EPYC escape: Case-study of a KVM breakout", "discussion_count": 1, "resource_count": 1, "component_id": "virtualization", "component_label": "Virtualization / containers", "component_detail": "virtualization or isolation boundary", "kernel_location": "virt/ + arch/*/kvm/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": false, "has_code": false, "has_exploit_link": false, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "704fd94e89fbc440", "title": "An EPYC escape: Case-study of a KVM breakout", "year": 2021, "authors": [ "Felix Wilhelm" ], "primary_url": "https://googleprojectzero.blogspot.com/2021/06/an-epyc-escape-case-study-of-kvm.html", "summary_zh": "研究与CVE-2021-29657相关的KVM突破案例。", "summary_en": "Examines a KVM breakout case study related to CVE-2021-29657.", "source_markdown": "[2021: \"An EPYC escape: Case-study of a KVM breakout\" by Felix Wilhelm](https://googleprojectzero.blogspot.com/2021/06/an-epyc-escape-case-study-of-kvm.html) [article] [CVE-2021-29657]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": false, "has_code": false, "has_exploit_link": false, "resources": [ { "label": "primary", "type": "article", "url": "https://googleprojectzero.blogspot.com/2021/06/an-epyc-escape-case-study-of-kvm.html", "raw_path": "/raw/2021-vulnerabilities-other-an-epyc-escape-case-study-of-a-kvm-breakout-primary-a9b08d76.txt" } ] } ], "rank": 242 }, { "cve": "CVE-2021-3492", "year": 2021, "name": "Exploitation of a double free vulnerability in Ubuntu shiftfs driver (CVE-2021-3492", "named_from_title": false, "name_source_title": "Exploitation of a double free vulnerability in Ubuntu shiftfs driver (CVE-2021-3492)", "discussion_count": 1, "resource_count": 1, "component_id": "filesystem", "component_label": "Filesystems / VFS / storage", "component_detail": "filesystem, VFS, or storage", "kernel_location": "fs/ + block/ + drivers/nvme/", "component_confidence": "medium", "android_priority": "low", "android_reason": "当前材料的目标环境偏桌面、服务器或虚拟化；不能据此排除共享代码影响。", "android_confirmed_in_sources": false, "has_poc": true, "has_code": false, "has_exploit_link": true, "latest_article_year": 2021, "article_years": [ 2021 ], "items": [ { "item_id": "8a48bc7aec1acfe0", "title": "Exploitation of a double free vulnerability in Ubuntu shiftfs driver (CVE-2021-3492)", "year": 2021, "authors": [ "Vincent Dehors" ], "primary_url": "https://www.synacktiv.com/publications/exploitation-of-a-double-free-vulnerability-in-ubuntu-shiftfs-driver-cve-2021-3492.html", "summary_zh": "该文章详细介绍了在Ubuntu shiftfs驱动程序中利用双重释放漏洞的方式。", "summary_en": "The article details the exploitation of a double free vulnerability in the Ubuntu shiftfs driver.", "source_markdown": "[2021: \"Exploitation of a double free vulnerability in Ubuntu shiftfs driver (CVE-2021-3492)\" by Vincent Dehors](https://www.synacktiv.com/publications/exploitation-of-a-double-free-vulnerability-in-ubuntu-shiftfs-driver-cve-2021-3492.html) [article] [CVE-2021-3492]", "affected_area": "", "android_status": "unknown", "android_confirmed": false, "android_reason": "Linux kernel vulnerability/exploit entry; Android production impact needs kernel-version and vendor-backport review.", "has_poc": true, "has_code": false, "has_exploit_link": true, "resources": [ { "label": "primary", "type": "article", "url": "https://www.synacktiv.com/publications/exploitation-of-a-double-free-vulnerability-in-ubuntu-shiftfs-driver-cve-2021-3492.html", "raw_path": "/raw/2021-vulnerabilities-lpe-exploitation-of-a-double-free-vulnerability-in-ubuntu-shiftfs-driver-cve-2021-3492-pr.txt" } ] } ], "rank": 243 } ] }