All issues

Search results

[RCU Leak] 查询不存在的 KPM 时直接返回，未释放 rcu_read_lock()

Status: Open.

#15 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026

[Safety Logic] 同一 module_init() 连续递增两次启动计数，KPM crash protection 阈值与持久化模型不成立

Status: Open.

#14 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026

[P0][ELF Parser] 未验证 e_shstrndx、sh_name 与 sh_link 边界，恶意 KPM 可触发内核越界读写

Status: Open.

#13 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026

[P0][Kernel Crash] KPM 只含 init 或只含 exit 时仍通过检查，随后无条件调用空函数指针

Status: Open.

#12 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026

[P0][Cred Integrity] SU_TASK 原地改写任意任务共享 cred 与 seccomp 字段，违反内核凭据不可变模型

Status: Open.

#11 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026

[P0][UAF] KPM 列表使用 RCU 读取却无写锁并立即释放模块代码，并发 control/unload 可执行已释放内存

Status: Open.

#10 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026

[User Pointer] SKEY_SET 校验内核副本后却再次读取原始用户指针，存在 TOCTOU 与内核故障窗口

Status: Open.

#9 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026

[P0][Info Leak] SUPERCALL_KPM_LIST 按用户 len 越界复制 4 KiB 栈缓冲区

Status: Open.

#8 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026

[Auth] superkey 校验不比较长度，正确密钥加任意后缀仍会通过认证

Status: Open.

#7 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026

[P0][AuthZ] 已授权 UID 无需超级密钥即可授权其他 UID、关闭安全模式并改写全局隐藏策略

Status: Open.

#6 In Zhanfg/KernelPatch-Public;

· Zhanfg opened on Aug 7, 2026