diff --git a/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh b/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh index 3f8dc97..5c521f1 100644 --- a/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh +++ b/linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh @@ -2,7 +2,7 @@ # ID: kernel_cve_registry_data # Author: Carlos Polop # Contributor: Arjay Saguisa -# Last Update: 29-06-2026 +# Last Update: 06-07-2026 # Description: Embedded kernel exploit matching datasets extracted from linux-exploit-suggester and linux-exploit-suggester-2 examples. Data is split across KERNEL_CVE_DATA_1..X with a maximum of 25 rows per env variable. This file also stores reference-only CVE tokens found in example repos when no explicit suggester matching rule exists. # License: GNU GPL # Version: 1.0 @@ -611,6 +611,7 @@ CVE-2026-31431 Copy Fail pkg=linux-kernel,ver>=6.2,ver<6.6.137,CONFIG_CRYPTO_USE CVE-2026-31431 Copy Fail pkg=linux-kernel,ver>=6.7,ver<6.12.85,CONFIG_CRYPTO_USER_API_AEAD=[my],CONFIG_CRYPTO_AUTHENC=[my] 1 Upstream issue introduced in 4.14; fixed by stable backports and in mainline 7.0 CVE-2026-31431 Copy Fail pkg=linux-kernel,ver>=6.13,ver<6.18.22,CONFIG_CRYPTO_USER_API_AEAD=[my],CONFIG_CRYPTO_AUTHENC=[my] 1 Upstream issue introduced in 4.14; fixed by stable backports and in mainline 7.0 CVE-2026-31431 Copy Fail pkg=linux-kernel,ver>=6.19,ver<6.19.12,CONFIG_CRYPTO_USER_API_AEAD=[my],CONFIG_CRYPTO_AUTHENC=[my] 1 Upstream issue fixed in 6.19.12 and mainline 7.0 +CVE-2026-43503 DirtyClone pkg=linux-kernel,ver>=3.9,ver<5.10.257 1 Fixed in stable 5.10.257; exploit path is in the networking stack and may be mitigated by removing the relevant ESP modules CVE-2017-16994 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from example repos; appears as related bypass mention CVE-2020-27171 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from example repos; appears as related comment in exploit source CVE-2024-0193 catalog_reference_only 9999.9999.9999 0 Reference-only CVE token from example repos; appears as upstream source reference @@ -623,6 +624,20 @@ EOF_DATA_21 )" KERNEL_CVE_DATA_22="$(cat <<'EOF_DATA_22' +CVE-2026-43503 DirtyClone pkg=linux-kernel,ver>=5.11,ver<5.15.208 1 Fixed in stable 5.15.208; exploit path is in the networking stack and may be mitigated by removing the relevant ESP modules +CVE-2026-43503 DirtyClone pkg=linux-kernel,ver>=5.16,ver<6.1.174 1 Fixed in stable 6.1.174; exploit path is in the networking stack and may be mitigated by removing the relevant ESP modules +CVE-2026-43503 DirtyClone pkg=linux-kernel,ver>=6.2,ver<6.6.141 1 Fixed in stable 6.6.141; exploit path is in the networking stack and may be mitigated by removing the relevant ESP modules +CVE-2026-43503 DirtyClone pkg=linux-kernel,ver>=6.7,ver<6.12.91 1 Fixed in stable 6.12.91; exploit path is in the networking stack and may be mitigated by removing the relevant ESP modules +CVE-2026-43503 DirtyClone pkg=linux-kernel,ver>=6.13,ver<6.18.33 1 Fixed in stable 6.18.33; exploit path is in the networking stack and may be mitigated by removing the relevant ESP modules +CVE-2026-43503 DirtyClone pkg=linux-kernel,ver>=6.19,ver<7.0.10 1 Fixed in stable 7.0.10 and mainline 7.1 +CVE-2026-46331 pedit COW pkg=linux-kernel,ver>=4.19.244,ver<4.20 1 Fixed before 4.20 in later backports; exploit path uses the traffic-control act_pedit subsystem +CVE-2026-46331 pedit COW pkg=linux-kernel,ver>=5.4.195,ver<5.5 1 Fixed before 5.5 in later backports; exploit path uses the traffic-control act_pedit subsystem +CVE-2026-46331 pedit COW pkg=linux-kernel,ver>=5.10.117,ver<5.11 1 Fixed before 5.11 in later backports; exploit path uses the traffic-control act_pedit subsystem +CVE-2026-46331 pedit COW pkg=linux-kernel,ver>=5.15.41,ver<5.16 1 Fixed before 5.16 in later backports; exploit path uses the traffic-control act_pedit subsystem +CVE-2026-46331 pedit COW pkg=linux-kernel,ver>=5.17.9,ver<5.18 1 Fixed before 5.18 in later backports; exploit path uses the traffic-control act_pedit subsystem +CVE-2026-46331 pedit COW pkg=linux-kernel,ver>=5.18,ver<6.12.94 1 Fixed in stable 6.12.94; exploit path uses the traffic-control act_pedit subsystem +CVE-2026-46331 pedit COW pkg=linux-kernel,ver>=6.13,ver<6.18.36 1 Fixed in stable 6.18.36; exploit path uses the traffic-control act_pedit subsystem +CVE-2026-46331 pedit COW pkg=linux-kernel,ver>=6.19,ver<7.0.13 1 Fixed in stable 7.0.13 and mainline 7.1 CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=3.16.52,ver<3.17,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue backported into 3.16 at 3.16.52; mitigated by kernel.yama.ptrace_scope >= 2 CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.4.40,ver<4.5,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue backported into 4.4 at 4.4.40; mitigated by kernel.yama.ptrace_scope >= 2 CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=4.8.16,ver<4.9,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue backported into 4.8 at 4.8.16; mitigated by kernel.yama.ptrace_scope >= 2 diff --git a/linPEAS/builder/linpeas_parts/variables/sidB.sh b/linPEAS/builder/linpeas_parts/variables/sidB.sh index aebfabc..0397e2b 100644 --- a/linPEAS/builder/linpeas_parts/variables/sidB.sh +++ b/linPEAS/builder/linpeas_parts/variables/sidB.sh @@ -1,7 +1,7 @@ # Title: Variables - sidB # ID: sidB # Author: Carlos Polop -# Last Update: 22-08-2023 +# Last Update: 06-07-2026 # Description: Dangerous sid binaries # License: GNU GPL # Version: 1.0 @@ -18,6 +18,7 @@ sidB="/apache2$%Read_root_passwd__apache2_-f_/etc/shadow\(CVE-2019-0211\)\ /at$%RTru64_UNIX_4.0g\(CVE-2002-1614\)\ /abrt-action-install-debuginfo-to-abrt-cache$%CENTOS 7.1/Fedora22\ /chfn$%SuSE_9.3/10\ + /check_icmp$%Monitoring_Plugins<3.0.1_if_setuid-root\(07-2026\)\ /chkey$%Solaris_2.5.1\ /chkperm$%Solaris_7.0_\ /chpass$%2Vulns:OpenBSD_6.1_to_OpenBSD 6.6\(CVE-2019-19726\)--OpenBSD_2.7_i386/OpenBSD_2.6_i386/OpenBSD_2.5_1999/08/06/OpenBSD_2.5_1998/05/28/FreeBSD_4.0-RELEASE/FreeBSD_3.5-RELEASE/FreeBSD_3.4-RELEASE/NetBSD_1.4.2\ @@ -69,4 +70,4 @@ sidB="/apache2$%Read_root_passwd__apache2_-f_/etc/shadow\(CVE-2019-0211\)\ /xlock$%BSD/OS_2.1/DG/UX_7.0/Debian_1.3/HP-UX_10.34/IBM_AIX_4.2/SGI_IRIX_6.4/Solaris_2.5.1\(04-1997\)\ /xscreensaver%Solaris_11.x\(CVE-2019-3010\)\ /xorg$%Xorg_1.19_to_1.20.x\(CVE_2018-14665\)/xorg-x11-server<=1.20.3/AIX_7.1_\(6.x_to_7.x_should_be_vulnerable\)_X11.base.rte<7.1.5.32_and_\ - /xterm$%Solaris_5.5.1_X11R6.3\(05-1997\)/Debian_xterm_version_222-1etch2\(01-2009\)" \ No newline at end of file + /xterm$%Solaris_5.5.1_X11R6.3\(05-1997\)/Debian_xterm_version_222-1etch2\(01-2009\)"