Tag: race-condition (3)
VCS Passport 2025 > final pokemon player
Vulnerability: Chương trình tin rằng biến toàn cục total_owned_pokemons được truy cập tuần tự, nhất quán, tuy nhiên 2 thread vẫn có thể tranh chấp dẫn đến TOC-TOU race condition -> ghi out-of-bound.
toc-tou
race-condition
sink-to-source
return-address-overwrite
rop
stack-buffer-overflow
out-of-bound
great-chall
February 14, 2026
•
December 20, 2025
•
Medium
CVE Reproduction > Reproducing Nimbuspwn: Linux Privilege Escalation via Path Traversal and TOCTOU in networkd-dispatcher
Vulnerability: Nimbuspwn breaks the invariant that “networkd-dispatcher only executes trusted root-owned scripts from its own hooks directory,” which is violated when an attacker first escapes the hooks path via directory traversal and then swaps the checked script path between validation and execution via a TOCTOU race to get arbitrary code run as root.
path-traversal
toc-tou
race-condition
linux
privilege-escalation
d-bus
systemd-networkd
networkd-dispatcher
sink-to-source
cve-2022-29799
cve-2022-29800
great-chall
February 14, 2026
•
November 9, 2025
•
Research