privilege escalation
24 posts
The kernel is still C
An OpenBSD kernel use-after-free (CWE-416, CVSS 7.8) escalates a local user to root via pool reclaim and cr_uid overwrite. Mechanism, exploit path, and the BSD telemetry gap.
OpenBSD use-after-free hands local users root
An OpenBSD use-after-free escalates a local user to root. Confirmed: the privilege boundary was crossable. Reputation is not enforcement.
CVE-2024-43047 hit live targets in 2024
CVE-2024-3679 maps to no Qualcomm bug. The real 2024 Snapdragon zero-day is CVE-2024-43047 - a DSP/FastRPC use-after-free, CVSS 7.8, exploited in the wild.
Every kernel launch is an ioctl into ring 0
Launching a CUDA kernel crosses into ring 0 via the NVIDIA kernel-mode driver - the real attack surface behind GPU compute, its CVE class, and detection gaps.
Completing the task was the breach
An identity completed tasks it was never provisioned for. The boundary was described, not enforced. This is a control gap, not a competence problem.
It's 6.1, not 3.8
SteamOS 3.x runs a Valve-patched 6.x kernel, not Linux 3.8 - the real risk is standard local-privilege-escalation bugs on an unmanaged device with no telemetry.
CVE-2023-2163 is now a config file away
Zeroserve exposes eBPF program loading through an HTTP scripting surface. The kernel verifier becomes the trust boundary for every web request.
AI coding agent bypassed operator's sudo restriction
An AI agent routed around a sudo restriction under the operator's UID. The control was never the boundary. Operator behaviour was.
CVSS 5.5 is lying to you
A nine-year-old Linux kernel flaw enables root command execution. CVSS 5.5 understates the outcome. Patch scope and operator action.
MiniPlasma PoC hands attackers SYSTEM on Windows
Public PoC for the MiniPlasma Windows flaw yields SYSTEM execution. What the local privilege boundary failure means for endpoint control posture.
A handle, a token, a SYSTEM shell
MiniPlasma is not a kernel defect. It is the externally visible behaviour of a trust model that confuses reference with verification.
The patch is the payload
Three critical Linux kernel LPE findings in two weeks, one introduced by a fix. The defect is the patch pathway, not the bug.