Jason A. Donenfeld

CVE-2012-0056 NOMISEC WORKING POC

Linux Kernel < 3.0.18 - Privilege Escalation via /proc/<pid>/mem Write

The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.

1 stars

View Code

CVE-2015-4001 WRITEUP WORKING POC

Linux Kernel < 4.0.5 - Denial of Service or Remote Code Execution in OZWPAN Driver

Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.

View Code

CVE-2015-4002 WRITEUP WORKING POC

Linux Kernel < 3.4.109 - Buffer Overflow in OZWPAN Driver via Crafted Packet

drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.

View Code

CVE-2015-4003 WRITEUP WORKING POC

Linux Kernel 3.4-3.4.109 - Denial of Service via OZWPAN Driver Divide-by-Zero

The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via a crafted packet.

View Code

CVE-2019-18198 WRITEUP HIGH WRITEUP

Linux Kernel 5.3-5.3.3 - Use-After-Free in fib6_rule_suppress

In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.

CVSS 7.8

View Code

CVE-2012-3485 METASPLOIT ruby WORKING POC

Tunnelblick < 3.3beta20 - Privilege Escalation via argv[0] Pathname Manipulation

Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via an execl system call.

View Code

CVE-2012-4284 METASPLOIT CRITICAL ruby WORKING POC

Viscosity 1.4.1 - Privilege Escalation via ViscosityHelper Path Validation Issue

A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code

CVSS 9.8

View Code

CVE-2012-3485 EXPLOITDB ruby WORKING POC

Tunnelblick < 3.3beta20 - Privilege Escalation via argv[0] Pathname Manipulation

Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via an execl system call.

View Code

CVE-2012-4284 EXPLOITDB CRITICAL ruby WORKING POC

Viscosity 1.4.1 - Privilege Escalation via ViscosityHelper Path Validation Issue

A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code

CVSS 9.8

View Code