Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-40019-Essiv — A PoC for CVE-2025-40019 in ESSIV module. (exploit WIP) | Kitploit
Tools/GitHubGitHub/xooxo/cve-2025-40019-essiv
Vulnerability AnalysisExploitationCryptographyBinary Exploitation
GitHubxooxo/cve-2025-40019-essiv

CVE-2025-40019-Essiv

A PoC for CVE-2025-40019 in ESSIV module. (exploit WIP)

View Repository
7 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-40019-Essiv

A PoC for CVE-2025-40019 in ESSIV module. (exploit WIP)

for exploitation, note that scatterlist (both req->src and req->dst) has page_link member. page_link is a way to encode sg table info alongside page pointer as far as I understand:

root@kitploit:~

(gdb) ptype struct scatterlist
type = struct scatterlist {
    unsigned long page_link;
    unsigned int offset;
    unsigned int length;
    dma_addr_t dma_address;
    unsigned int dma_length;
    unsigned int dma_flags;
}

scatterwalk_start_at_pos (pos=8, sg=0xffff8880084c5020, walk=<optimized out>) at ./include/crypto/scatterwalk.h:97
97              while (pos > sg->length) {

(gdb) set $pl = (unsigned long)sg->page_link

(gdb) set $page = (struct page *)($pl & ~0x3)

(gdb) p $page

$66 = (struct page *) 0xffffea0000722700
(gdb) p *$page

$67 = {
  flags = 72057594038061324,
  {
    {
      {
        lru = {
          next = 0x0 <__pfx_init_module>,
          prev = 0xdead000000000122
        },
        {
          __filler = 0x0 <__pfx_init_module>,
          mlock_count = 290
        },
        buddy_list = {
          next = 0x0 <__pfx_init_module>,
          prev = 0xdead000000000122
        },
        pcp_list = {
          next = 0x0 <__pfx_init_module>,
          prev = 0xdead000000000122
        },
        {
          pcp_llist = {
            next = 0x0 <__pfx_init_module>
          },
          order = 290
        }
      },
      mapping = 0xffff88800ba92cc1,
      {
        __folio_index = 34359738366,
        share = 34359738366
      },
      private = 0
    },
    {
      pp_magic = 0,
      pp = 0xdead000000000122,
      _pp_mapping_pad = 18446612682265668801,
      dma_addr = 34359738366,
      pp_ref_count = {
        counter = 0
      }
    },
    {
      compound_head = 0
    },
    {
      _unused_pgmap_compound_head = 0x0 <__pfx_init_module>,
      zone_device_data = 0xdead000000000122
    },
    callback_head = {
      next = 0x0 <__pfx_init_module>,
      func = 0xdead000000000122
    }
  },
  {
    page_type = 0,
    _mapcount = {
      counter = 0
    }
  },
--Type <RET> for more, q to quit, c to continue without paging--

  _refcount = {
    counter = 1026
  }
}

Download Tool