diff --git a/docs/index.html b/docs/index.html index 110adcd..b5c742e 100644 --- a/docs/index.html +++ b/docs/index.html @@ -99,53 +99,42 @@ -

- Sortable by clicking column headers. 🟒 = lands root by - default · 🟑 = primitive + opt-in --full-chain. -

+

🟒 Lands root on a vulnerable host

+

Structural exploits + page-cache writes. No per-kernel offsets needed.

+
+ copy_fail + copy_fail_gcm + dirty_frag_esp + dirty_frag_esp6 + dirty_frag_rxrpc + dirty_pipe + dirty_cow + pwnkit + overlayfs + overlayfs_setuid + cgroup_release_agent + ptrace_traceme + sudoedit_editor + entrybleed +
-
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
YearCVEBugModuleTier
2024CVE-2024-1086nf_tables nft_verdict_init cross-cache UAFnf_tables🟑 primitive
2023CVE-2023-32233nf_tables anonymous-set UAFnft_set_uaf🟑 primitive
2023CVE-2023-22809sudoedit EDITOR/VISUAL -- argv escapesudoedit_editor🟒 full chain
2023CVE-2023-4622AF_UNIX garbage-collector race UAFaf_unix_gc🟑 primitive
2023CVE-2023-3269StackRot β€” maple-tree VMA-split UAFstackrot🟑 primitive
2023CVE-2023-2008vmwgfx DRM buffer-object OOB writevmwgfx🟑 primitive
2023CVE-2023-0386overlayfs copy_up preserves setuid bitoverlayfs_setuid🟒 full chain
2023CVE-2023-0458EntryBleed β€” KPTI prefetchnta KASLR bypassentrybleed🟒 leak
2023CVE-2023-0179nft_payload set-id memory corruptionnft_payload🟑 primitive
2022CVE-2022-25636nft_fwd_dup_netdev_offload heap OOBnft_fwd_dup🟑 primitive
2022CVE-2022-2588net/sched cls_route4 dangling-filter UAFcls_route4🟑 primitive
2022CVE-2022-0492cgroup v1 release_agent ns mismatchcgroup_release_agent🟒 full chain
2022CVE-2022-0847Dirty Pipe β€” page-cache write via splicedirty_pipe🟒 full chain
2022CVE-2022-0185fsconfig legacy_parse_param 4k heap OOBfuse_legacy🟑 primitive
2021CVE-2021-33909Sequoia β€” seq_file size_tβ†’int wrapsequoia🟑 primitive
2021CVE-2021-3156sudo Baron Samedit heap overflowsudo_samedit🟑 primitive
2021CVE-2021-3493Ubuntu overlayfs userns file-cap injectionoverlayfs🟒 full chain
2021CVE-2021-22555iptables xt_compat 4-byte heap OOBnetfilter_xtcompat🟑 primitive
2021CVE-2021-4034Pwnkit β€” pkexec NULL argv env-injectionpwnkit🟒 full chain
2020CVE-2020-14386AF_PACKET tp_reserve integer underflowaf_packet2🟑 primitive
2019CVE-2019-13272PTRACE_TRACEME β†’ setuid execve raceptrace_traceme🟒 full chain
2017CVE-2017-7308AF_PACKET TPACKET_V3 integer overflowaf_packet🟑 primitive
2016CVE-2016-5195Dirty COW β€” COW race via /proc/self/memdirty_cow🟒 full chain
2026CVE-2026-31431Copy Fail β€” algif_aead authencesn page-cache writecopy_fail🟒 full chain
2026CVE-2026-43284Dirty Frag β€” IPv4 xfrm-ESP page-cache writedirty_frag_esp🟒 full chain
2026CVE-2026-43284Dirty Frag β€” IPv6 xfrm-ESP (esp6)dirty_frag_esp6🟒 full chain
2026CVE-2026-43500Dirty Frag β€” RxRPC handshake forgerydirty_frag_rxrpc🟒 full chain
2026variantCopy Fail GCM β€” rfc4106(gcm(aes)) siblingcopy_fail_gcm🟒 full chain
+

🟑 Fires kernel primitive · opt-in --full-chain

+

Default returns EXPLOIT_FAIL honestly. With --full-chain + resolved offsets, runs the shared modprobe_path finisher.

+
+ nf_tables + nft_set_uaf + nft_fwd_dup + nft_payload + netfilter_xtcompat + af_packet + af_packet2 + af_unix_gc + cls_route4 + fuse_legacy + stackrot + sudo_samedit + sequoia + vmwgfx
@@ -292,36 +281,6 @@ function copyInstall(btn) { }); } -/* CVE table sort */ -(function() { - var table = document.getElementById('cve-table'); - if (!table) return; - var headers = table.querySelectorAll('th.sortable'); - headers.forEach(function(th, idx) { - th.style.cursor = 'pointer'; - th.addEventListener('click', function() { - var tbody = table.querySelector('tbody'); - var rows = Array.prototype.slice.call(tbody.querySelectorAll('tr')); - var dir = th.getAttribute('data-dir') === 'asc' ? 'desc' : 'asc'; - headers.forEach(function(h) { h.removeAttribute('data-dir'); }); - th.setAttribute('data-dir', dir); - rows.sort(function(a, b) { - var av = a.children[idx].innerText.trim(); - var bv = b.children[idx].innerText.trim(); - var na = parseFloat(av), nb = parseFloat(bv); - if (!isNaN(na) && !isNaN(nb)) { av = na; bv = nb; } - if (av < bv) return dir === 'asc' ? -1 : 1; - if (av > bv) return dir === 'asc' ? 1 : -1; - return 0; - }); - rows.forEach(function(r) { tbody.appendChild(r); }); - }); - }); - /* default sort: Year desc */ - var first = table.querySelector('th[data-key="year"]'); - if (first) first.click(); /* asc */ - if (first) first.click(); /* desc */ -})(); diff --git a/docs/style.css b/docs/style.css index b8bb499..8c07be6 100644 --- a/docs/style.css +++ b/docs/style.css @@ -253,66 +253,6 @@ section h3 { .pill.green { border-color: rgba(63, 185, 80, 0.4); color: var(--green); } .pill.yellow { border-color: rgba(210, 153, 34, 0.4); color: var(--yellow); } -/* CVE table */ -.table-wrap { - overflow-x: auto; - border: 1px solid var(--border); - border-radius: 6px; - background: var(--bg-elevated); -} -table.cve-table { - width: 100%; - border-collapse: collapse; - font-size: 0.9rem; -} -table.cve-table th, -table.cve-table td { - text-align: left; - padding: 0.55rem 0.85rem; - border-bottom: 1px solid var(--border); - vertical-align: top; - white-space: nowrap; -} -table.cve-table th { - background: rgba(255, 255, 255, 0.02); - color: var(--text-muted); - font-weight: 600; - font-size: 0.82rem; - text-transform: uppercase; - letter-spacing: 0.05em; -} -table.cve-table th.sortable { cursor: pointer; user-select: none; } -table.cve-table th.sortable:hover { color: var(--text); } -table.cve-table th[data-dir="asc"]::after { content: " β–²"; opacity: 0.7; } -table.cve-table th[data-dir="desc"]::after { content: " β–Ό"; opacity: 0.7; } -table.cve-table td:nth-child(3) { white-space: normal; min-width: 280px; } -table.cve-table tr:last-child td { border-bottom: none; } -table.cve-table tr:hover td { background: rgba(255, 255, 255, 0.025); } -table.cve-table code { - background: rgba(255, 255, 255, 0.04); - border: 1px solid var(--border); - padding: 0.05rem 0.3rem; - border-radius: 3px; - font-size: 0.86em; -} - -.tier { - display: inline-block; - font-family: var(--mono); - font-size: 0.78rem; - padding: 0.15rem 0.5rem; - border-radius: 4px; - border: 1px solid var(--border); -} -.tier.green { color: var(--green); border-color: rgba(63, 185, 80, 0.4); } -.tier.yellow { color: var(--yellow); border-color: rgba(210, 153, 34, 0.4); } - -@media (max-width: 600px) { - table.cve-table { font-size: 0.82rem; } - table.cve-table th, - table.cve-table td { padding: 0.45rem 0.6rem; } -} - /* Code block */ pre.code { background: var(--bg-elevated);