CVE-2024-6768 is a vulnerability in the Common Log File System (CLFS.sys) driver of Windows, caused by improper validation of specified quantities in input data. This flaw leads to an unrecoverable inconsistency, triggering the KeBugCheckEx function and resulting in a Blue Screen of Death (BSoD). The issue affects all versions of Windows 10 and Windows 11, Windows Server 2016, Server 2019 and Server 2022 despite having all updates applied. This Proof of Concept (PoC) shows that by crafting specific values within a .BLF file, an unprivileged user can induce a system crash.
0ec1d82e1e6a31fe57b2e6f518e950e98281a0c7e322246a6ffaddcc34e5296a
A guest inside a VirtualBox VM using the virtio-net network adapter can trigger an intra-object out-of-bounds write in src/VBox/Devices/Network/DevVirtioNet.cpp to cause a denial-of-service or escape the hypervisor and compromise the host. This is Google's proof of concept exploit.
39886fd5b29cda0221f294d1907d9e63995ec85c9ee702b13d91f845a49e1f06
AMD Errata 1386 1 is a flaw that affects the AMD Zen 2 family of processors. The observed result of this bug is that changes to xmm or ymm extended registers during normal program execution may be unexpectedly discarded. The implications of this flaw will vary depending on the workload. This is Google's proof of concept exploit.
8a75f5fb07a6ca67733cb5a1185477da6a8313afd2a241201dd4016d48542554
This is a proof of concept code from Google called RET2ASLR - Leaking ASLR from return instructions.
85855938129f6904b076bc6c171882d2c77607f62f7812008d8e9444f550c17d
Google observed some undocumented (to the best of their knowledge) behavior of the indirect branch predictors, specifically relative to _ret_ instructions. The research they conducted appears to show that this behavior does not seem to create exploitable security vulnerabilities in the software they have tested. They would like to better understand the impact and implications for different software stacks, thus they welcome feedback or further research. Included is proof of concept code.
ebca14f100ab1f543d3c2aebe9a56b5068ca62d114ff25a3d83d52c2308a7399
This is a path traversal vulnerability that impacts the CreateIndexHandler and DeleteIndexHandler found within Bleve search library. These vulnerabilities enable the attacker to delete any directory owned by the user recursively, and create a new directory in any location which the server has write permissions to. This is Google's proof of concept exploit.
fa85d4f73ca7779ddd8389e832e0e1c1e86090421d04d1696926164a39351fbf
The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. This is Google's proof of concept exploit.
6c56ab2bf4efebb0273749421604fdf5621afcb2f63120ab2ed4f06a76ac978b
libresolv's DNS packet handler suffered from heap out-of-bounds write to infinite-loop denial of service vulnerabilities. This is a proof of concept exploit from Google.
6505c0cb893baf4196eb16135d2af856db40e233dd1d7965e3bc7bd9551a1998
Log4j 2.15.0 was released to address the widely reported JNDI Remote Code Execution (RCE) (CVE-2021-44228) vulnerability in Log4j. Shortly thereafter, 2.16.0 was released to address a Denial of Service (DoS) vulnerability (CVE-2021-45046). When examining the 2.15.0 release, Google security engineers found several issues with the Log4j 2.15.0 patch that showed that the severity of the issue addressed in 2.16 was in fact worse than initially understood. This is Google's proof of concept exploit.
c42c53b6fbd06585bd6895ecad8dddaa20237bb0cbb68646781ab1bf7e1461f2
On Surface Pro 3 with the SHA1 and SHA256 PCRs enabled on the TPM, BIOS version 3.11.2550 and earlier, only the SHA1 PCRs are extended by the firmware. This means that an adversary can boot into an unmeasured OS and extend the PCRs with false measurements to obtain false attestations. This is a proof of concept exploit from Google.
35bf7da7bc7ce653790a7765ec266d8289cd1a0536910f29505b37576ba96dfd
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This is the proof of concept exploit produced by Google.
7e21453bd35ea03ac243c883156335ec9936d2ef9ea62d6308ff99dc3b26d7a5
Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This is a proof of concept exploit produced by Google.
ad1315873367c17209fa30fde20446a3d19e938e62e5ccfbfbe5f855fc3a83c4
This is a proof of concept exploit to bypass two factor authentication in Mailcow versions prior to 2024-07.
bf1ae4179a96942ee298b8815a404b831648737aefc69dfbb375f4f47c292c8a
This archive contains three proof of concepts exploit for multiple Microsoft SharePoint remote code execution vulnerabilities.
d80ffcbe99aa73f58e248f00ca3af5b3281e817bc026be01942991e895b4530a
VMWare Aria Operations for Networks (vRealize Network Insight) is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This is a proof of concept exploit.
c714227bbfea1d4fec4126f79c54dfdd4ec91c95a6e8c0ffc7b795b17b7901ee
Veeam Backup Enterprise Manager authentication bypass proof of concept exploit. Versions prior to 12.1.2.172 are vulnerable.
31fb3b66c17ab7cbfde346b10334c22f95eded003360d0eab92157d99cefd29c
Veeam Recovery Orchestrator authentication bypass proof of concept exploit.
c7b976542137634b6839638c2c6a072b32e8cf78c61435488fcde8c526101303
Progress WhatsUp Gold WriteDatafile unauthenticated remote code execution proof of concept exploit.
8555b3fc19ed4287c691eed2de41c35a867aa34e1477c6e4b70035490dca6662
Progress WhatsUp Gold GetFileWithoutZip unauthenticated remote code execution proof of concept exploit.
645be8b10a258029fe6ad8527b1a56a51a5c0b7d9500967dd05deb6a107887f2
Proof of concept exploit for Check Point Security Gateways that allows an unauthenticated remote attacker to read the contents of an arbitrary file located on the affected appliance.
7bb4866aa20c857a3bde162427591e069c170227d7fad3568d19f0f03e9a2e1e
This archive is a GhostRace proof of concept exploit exemplifying the concept of a speculative race condition in a step-by-step single-threaded fashion. Coccinelle scripts are used to scan the Linux kernel version 5.15.83 for Speculative Concurrent Use-After-Free (SCUAF) gadgets.
37e02a934f238521d1f775356b1e8c43d4c6a81948b9dad1162cc1387ca9c199
The Security Explorations team has come up with two attack scenarios that make it possible to extract private ECC keys used by a PlayReady client (Windows SW DRM scenario) for the communication with a license server and identity purposes. Proof of concept included.
c2dc2010ee36581d568d891c24ac2a0dfd8b8a87de8de3d72f1072bb1e38964a
The Microsoft PlayReady toolkit assists with fake client device identity generation, acquisition of license and content keys for encrypted content, and much more. It demonstrates weak content protection in the environment of CANAL+. The proof of concept exploit 3 year old vulnerabilities in CANAL+ STB devices, which make it possible to gain code execution access to target STB devices over an IP network.
79dab3a7323f19a26d78f497deb3ea0052f2376b984ec830648a755230a60801
htmlLawed versions 1.2.5 and below proof of concept remote command execution exploit.
f7c13b91b7562803551ff2c81af4d91f8007cf734173bc191c1002abafa0fa8f
Proof of concept code that demonstrates how the Windows kernel suffers from a privilege escalation vulnerability due to a double-fetch in PspBuildCreateProcessContext that leads to a stack buffer overflow.
0d419f34140c82908299252d3794e80651aedada14ee132d75462cbcf8700e96