MCPcopy Create free account

hub / github.com/bsauce/kernel-exploit-factory / functions

Functions847 in github.com/bsauce/kernel-exploit-factory

⨍ Functions 847◇ Types & classes 1,074
↓ 2 callersFunctionleak_heap
leak_heap() —— leak heap addr of `net_device` object in child & parent process
CVE-2022-25636/exploit/exploit.c:276
↓ 2 callersFunctionlookup_map_element
CVE-2021-3490/exp/5.11.16/Linux_LPE_eBPF_CVE-2021-3490-main/bpf.c:40
↓ 2 callersFunctionmake_queue
CVE-2022-25636/exploit/exploit.c:77
↓ 2 callersFunctionmigrate_to_cpu0
设置仅在 CPU 0 上运行
CVE-2017-11176/exp-centos-3100.c:94
↓ 2 callersFunctionmigrate_to_cpu0
设置仅在 CPU 0 上运行
CVE-2017-11176/exp-slab-4119.c:82
↓ 2 callersFunctionmsg_free
CVE-2021-4154/exploit/exploit-ROP.c:274
↓ 2 callersFunctionnetlink_add_addr
CVE-2022-27666/exploit/exploit.c:559
↓ 2 callersFunctionnetlink_add_addr4
CVE-2022-27666/exploit/exploit.c:575
↓ 2 callersFunctionnetlink_add_addr6
CVE-2022-27666/exploit/exploit.c:585
↓ 2 callersFunctionnetlink_add_geneve
CVE-2022-27666/exploit/exploit.c:496
↓ 2 callersFunctionnetlink_add_ipvlan
CVE-2022-27666/exploit/exploit.c:519
↓ 2 callersFunctionnetlink_add_macvlan
CVE-2022-27666/exploit/exploit.c:480
↓ 2 callersFunctionnetlink_add_vlan
CVE-2022-27666/exploit/exploit.c:464
↓ 2 callersFunctionnetlink_query_family_id
CVE-2022-27666/exploit/exploit.c:356
↓ 2 callersFunctionnetlink_send
netlink_send() —— 通过 netlink 来发送tipc包, 请求或配置tipc
CVE-2021-43267/exp1.c:124
↓ 2 callersFunctionnetwork_interface_up
CVE-2025-21702/exploit/exploit.c:623
↓ 2 callersFunctionoob_setup
计算 sizeof_priv
CVE-2017-7308/exploit.c:189
↓ 2 callersFunctionoob_write
CVE-2017-7308/exploit.c:199
↓ 2 callersFunctionovsmsg_send
ovsmsg_send() —— construct vulnerable nlmsghdr -> genlmsghdr -> nlattr packet and send
CVE-2022-2639/exploit.c:303
↓ 2 callersFunctionpacket_socket_rx_ring_init
Helpers 调用 setsockopt(..., PACKET_RX_RING, ...) 来使内核分配 ring buffer 环形缓冲区
CVE-2017-7308/exploit.c:77
↓ 2 callersFunctionpacket_socket_send
CVE-2017-7308/exploit.c:133
↓ 2 callersFunctionpacket_socket_setup
(1-2) 消耗页面分配器的 0x8000
CVE-2017-7308/exploit.c:104
↓ 2 callersFunctionprepare_uaf
CVE-2025-21702/exploit/exploit.c:1001
↓ 2 callersFunctionprint_hex
CVE-2021-4154/exploit/exploit-ROP.c:35
↓ 2 callersFunctionradix_tree_is_internal_node
CVE-2021-3490/exp/5.11.16/Linux_LPE_eBPF_CVE-2021-3490-main/kmem_search.c:34
↓ 2 callersFunctionread64
CVE-2021-43267/exp1.c:117
↓ 2 callersFunctionread_msg
CVE-2026-23271/exploit/exploit.cpp:2133
↓ 2 callersFunctionrecv_msg
CVE-2021-42008/exp.c:439
↓ 2 callersFunctionrule_add_bit_shift
CVE-2022-1015/exploit/helpers.c:154
↓ 2 callersFunctionrule_add_immediate_verdict
CVE-2022-1015/exploit/helpers.c:218
↓ 2 callersFunctionsafe_write_field_tagged
CVE-2026-23271/exploit/exploit.cpp:2026
↓ 2 callersFunctionsend_msg
CVE-2022-25636/exploit/exploit.c:94
↓ 2 callersFunctionsend_packet_to_network_interface
send_packet_to_network_interface() - construct msghdr and call sendmsg()
CVE-2025-21702/exploit/exploit.c:599
↓ 2 callersFunctionset_cpu_affinity
CVE-2022-32250/exploit/exploit.c:165
↓ 2 callersFunctionsetup_memfd_page
setup_memfd_page() —— 创建匿名文件，并快速分配文件空间
CVE-2023-2598/exploit.c:55
↓ 2 callersFunctionsetup_namespace
CVE-2022-2588/exploit.c:182
↓ 2 callersFunctionspray_4k
spray 4096 msg_msg in kmalloc-4k
CVE-2022-0185/exploit/exploit_kctf.c:134
↓ 2 callersFunctionspray_4k
spary msg_msg in kmalloc-4k
CVE-2022-0185/exploit/exploit_fuse.c:218
↓ 2 callersFunctionspray_4k_thread
use setxattr() to spray n * 8 kmalloc-4k ----- use thread
CVE-2022-27666/exploit/exploit.c:1260
↓ 2 callersFunctionspray_keyring_list_del_purpose
spray_keyring_list_del_purpose() —— spray `user_key_payload` to forge msg_msg
CVE-2022-32250/exploit/exploit.c:402
↓ 2 callersFunctionspray_mqueue
spray_mqueue() —— spray `posix_msg_tree_node`
CVE-2022-32250/exploit/exploit.c:387
↓ 2 callersFunctionspray_setxattr
CVE-2019-15666/exp.c:410
↓ 2 callersFunctionspray_skbuff_data
spray 4*0x20 sk_buff->data
CVE-2022-2639/exploit.c:673
↓ 2 callersFunctiontiger
triger —— 触发漏洞
CVE-2017-11176/exp-centos-3100.c:168
↓ 2 callersFunctiontiger
triger —— 触发漏洞
CVE-2017-11176/exp-slab-4119.c:156
↓ 2 callersFunctiontipc_trigger
tipc_trigger() —— 构造 tipc 消息触发 tipc 漏洞
CVE-2021-43267/exp1.c:479
↓ 2 callersFunctiontp_create_target_event_common
创建用于竞态触发的 tracepoint 类型 perf_event 关键配置: sigtrap=1, sample_period=1 (每次命中都 overflow), exclude_kernel=1 (只触发用户态事件), disabled=1 (手动 enable) 使用 PERF_EVEN
CVE-2026-23271/exploit/exploit.cpp:716
↓ 2 callersFunctiontp_disable_and_close_if_open_ret
CVE-2026-23271/exploit/exploit.cpp:780
↓ 2 callersFunctiontp_maybe_apply_warn_wake_hold
CVE-2026-23271/exploit/exploit.cpp:441
↓ 2 callersFunctiontp_try_open_spray_gate
CVE-2026-23271/exploit/exploit.cpp:567
↓ 2 callersFunctiontp_user_membarrier_global
CVE-2026-23271/exploit/exploit.cpp:580
↓ 2 callersFunctiontp_warn_open_gate_and_wait_spray
通知 Sprayer 线程开始堆喷
CVE-2026-23271/exploit/exploit.cpp:461
↓ 2 callersFunctiontrigger_uaf
CVE-2025-21702/exploit/exploit.c:1077
↓ 2 callersFunctiontrigger_vuln
trigger_vuln() —— trigger OOB and palce vul_data
CVE-2022-2639/exploit.c:551
↓ 2 callersFunctionudp_fifo_kmalloc_small
CVE-2017-6074/exp.c:226
↓ 2 callersFunctionupdate_elem
CVE-2020-8835/exp/exp_multi_core.c:448
↓ 2 callersFunctionupdate_elem
CVE-2020-8835/exp/exp_single_core.c:446
↓ 2 callersFunctionuser_key_payload_free_and_wait_for_gc
CVE-2025-21702/exploit/exploit.c:878
↓ 2 callersFunctionvuln
vuln() —— trigger OOB write (legit_writes - # of legit rules; oob_writes - # of OOB rules)
CVE-2022-25636/exploit/exploit.c:112
↓ 2 callersFunctionwrite64
CVE-2021-31440/exp/CVE-2021-31440.c:385
↓ 2 callersFunctionwrite64
CVE-2021-31440/exp/CVE-2021-31440_2.c:386
↓ 2 callersFunctionwrite64
CVE-2020-27194/exp/CVE-2020-27194.c:353
↓ 2 callersFunctionwrite64
CVE-2021-3490/exp/5.11/CVE-2021-3490.c:388
↓ 2 callersFunctionwriteMsg
CVE-2022-0995/exploit.c:123
↓ 2 callersFunctionwrite_msg
CVE-2021-22555/exploit.c:179
↓ 2 callersFunctionwritemsg
CVE-2020-8835/exp/exp_multi_core.c:434
↓ 2 callersFunctionwritemsg
CVE-2020-8835/exp/exp_single_core.c:432
↓ 2 callersFunctionxfrm_policy_spray_trigger_alloc
xfrm_policy_spray_trigger_alloc() - spray (to-from) `xfrm_policy`
CVE-2025-21702/exploit/exploit.c:961
↓ 2 callersFunctionxfrm_policy_spray_trigger_free
xfrm_policy_spray_trigger_free() - free all `xfrm_policy`
CVE-2025-21702/exploit/exploit.c:984
↓ 1 callersFunctionAdd_key
CVE-2025-21702/exploit/exploit.c:448
↓ 1 callersFunctionKeyctl_read
CVE-2025-21702/exploit/exploit.c:462
↓ 1 callersFunctionKeyctl_read_alloc
CVE-2025-21702/exploit/exploit.c:470
↓ 1 callersFunctionOpen
CVE-2025-21702/exploit/exploit.c:478
↓ 1 callersFunctionSched_setaffinity
CVE-2025-21702/exploit/exploit.c:540
↓ 1 callersFunctionSendmsg
CVE-2025-21702/exploit/exploit.c:494
↓ 1 callersFunctionUnshare
CVE-2025-21702/exploit/exploit.c:534
↓ 1 callersFunctionVasprintf
CVE-2025-21702/exploit/exploit.c:526
↓ 1 callersFunctionWrite
CVE-2025-21702/exploit/exploit.c:486
↓ 1 callersFunction__get_fp
CVE-2017-16995/exp.c:222
↓ 1 callersFunction__radix_tree_lookup
CVE-2021-3490/exp/5.11.16/Linux_LPE_eBPF_CVE-2021-3490-main/kmem_search.c:75
↓ 1 callersFunction__write
CVE-2017-16995/exp.c:234
↓ 1 callersFunction__xfrm_add_policy0
CVE-2019-15666/exp.c:177
↓ 1 callersFunction__xfrm_add_policy1
CVE-2019-15666/exp.c:227
↓ 1 callersFunction__xfrm_flush_policy0
CVE-2019-15666/exp.c:146
↓ 1 callersFunction__xfrm_hash_rebuild
CVE-2019-15666/exp.c:99
↓ 1 callersFunctionadd_child
CVE-2022-1015/exploit/helpers.c:265
↓ 1 callersFunctionadd_note
CVE-2015-8550/exp.c:62
↓ 1 callersFunctionadd_rmem_alloc
通过sendmsg 增加 sk_rmem_alloc，使其 > sk_rcvbuf
CVE-2017-11176/exp-centos-3100.c:105
↓ 1 callersFunctionadd_rmem_alloc
通过sendmsg 增加 sk_rmem_alloc，使其 > sk_rcvbuf
CVE-2017-11176/exp-slab-4119.c:93
↓ 1 callersFunctionalloc_msg_queue_A
CVE-2021-42008/exp.c:412
↓ 1 callersFunctionalloc_msg_queue_B
CVE-2021-42008/exp.c:602
↓ 1 callersFunctionalloc_shm
alloc_shm() —— spray 100 shm_file_data in kmalloc-32
CVE-2021-42008/exp.c:387
↓ 1 callersFunctionam_i_root
CVE-2022-27666/exploit/exploit.c:1750
↓ 1 callersFunctionarb_write
arb write ---- try 8 times
CVE-2022-27666/exploit/exploit.c:1677
↓ 1 callersFunctionassign_to_core
CVE-2021-42008/exp.c:122
↓ 1 callersFunctionattach_bpf_prog
CVE-2021-41073/exploit/bpf.c:90
↓ 1 callersFunctionbind_cpu
CVE-2022-2639/exploit.c:518
↓ 1 callersFunctionbind_on_cpu
bind_on_cpu() —— run on single core
CVE-2019-15666/exp.c:77
↓ 1 callersFunctionbpf_create_map
CVE-2017-16995/exp.c:137
↓ 1 callersFunctionbpf_create_map
CVE-2021-31440/exp/CVE-2021-31440.c:143
← previousnext →201–300 of 847, ranked by callers