Nelson Elhage

3 exploits Active since Apr 2011
CVE-2011-1751 WRITEUP WORKING POC
qemu - Denial of Service via PIIX4 Power Management PCI-ISA Bridge Unplug
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
CVE-2011-1083 EXPLOITDB c WORKING POC
Linux Kernel < 2.6.37.2 - Denial of Service via epoll File Descriptor Tree Traversal
The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
CVE-2011-1082 EXPLOITDB c WORKING POC
Linux Kernel < 2.6.38 - Denial of Service via epoll File Descriptor Chaining
fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.