delphos-labs/disclosures

disclosures is a public repository from Delphos Labs, a security research group, where they publish vulnerability disclosures and proof-of-concept exploit code for security flaws they have found. It is written mostly in C, matching the kind of low-level exploit code typically needed to demonstrate operating system and kernel level vulnerabilities. As of this writing, the repository lists a single disclosure named DirtyCBC. According to the README, it describes a Linux kernel bug involving page-cache poisoning through a networking component called AF_RXRPC, related to how RxGK handles decryption and message authentication ordering, combined with a memory feature called MSG_SPLICE_PAGES. The stated impact is a local privilege escalation, meaning a regular user on an affected system could potentially gain full root access. The README states that all vulnerabilities listed in the repository were first reported privately to the maintainers of the affected software and were patched before being disclosed publicly here, following standard responsible disclosure practice. The proof-of-concept code is described as intended for defensive validation and security research only, not for use against systems without authorization. This is a small, focused repository rather than a general purpose tool: it functions as an archive of the group's published findings rather than something to install or run as an application. The README is brief and mostly a table of disclosures with dates, so there is limited detail beyond what is summarized here. Licensing is not uniform: the README notes that individual disclosures inside the repository may each carry their own separate license, so anyone reusing the code should check each disclosure's own directory rather than assuming one blanket license applies.