Tag: privilege-escalation (3)
CVE Reproduction > Reproducing Nimbuspwn: Linux Privilege Escalation via Path Traversal and TOCTOU in networkd-dispatcher
Vulnerability: Nimbuspwn breaks the invariant that “networkd-dispatcher only executes trusted root-owned scripts from its own hooks directory,” which is violated when an attacker first escapes the hooks path via directory traversal and then swaps the checked script path between validation and execution via a TOCTOU race to get arbitrary code run as root.
path-traversal
toc-tou
race-condition
linux
privilege-escalation
d-bus
systemd-networkd
networkd-dispatcher
sink-to-source
cve-2022-29799
cve-2022-29800
great-chall
February 14, 2026
•
November 9, 2025
•
Research