Novumos
Monthly
Local privilege escalation in NovumOS allows an authenticated user with shell access to load a malicious .nv script that the Nova interpreter executes in Ring 0, giving unrestricted kernel-memory access and code execution at kernel privilege with scope change and high confidentiality, integrity and availability impact. The root cause is architectural rather than a memory-safety defect: Nova is not confined to a Ring 3 domain and no special feature toggle is required, so any loadable script runs with full kernel rights on versions at or before 0.23. A public PoC reference (a sample Nova script writing to kernel memory) is included in the GitHub advisory; it is not verified as working exploit code, there is no KEV listing, and exploitation is limited by the need for local access and the small installed base.
Privilege escalation in NovumOS versions prior to 0.24 allows local unprivileged attackers to gain kernel-level execution by manipulating core kernel structures. The vulnerable Syscall 15 (MemoryMapRange) permits user-mode processes to map arbitrary virtual memory regions, including protected kernel areas (IDT, GDT, TSS, page tables), enabling modification of interrupt handlers for privilege elevation. CISA SSVC framework confirms POC availability with total technical impact, though EPSS exploitation probability remains very low (0.01%, 2nd percentile), indicating research-phase discovery rather than widespread targeting. No CISA KEV listing at time of analysis. Vendor-released patch available in version 0.24.
Syscall 12 (JumpToUser) in NovumOS versions prior to 0.24 executes arbitrary kernel code at Ring 0 privilege when invoked by unprivileged Ring 3 user-mode processes. The vulnerability stems from missing address validation on user-supplied entry points, enabling local privilege escalation from user mode to kernel mode with complete system control. CISA SSVC framework confirms publicly available exploit code (POC status) with total technical impact, though EPSS score remains low at 0.02% (5th percentile), suggesting limited real-world targeting of this niche custom operating system despite the severe technical flaw.
Local privilege escalation in NovumOS allows an authenticated user with shell access to load a malicious .nv script that the Nova interpreter executes in Ring 0, giving unrestricted kernel-memory access and code execution at kernel privilege with scope change and high confidentiality, integrity and availability impact. The root cause is architectural rather than a memory-safety defect: Nova is not confined to a Ring 3 domain and no special feature toggle is required, so any loadable script runs with full kernel rights on versions at or before 0.23. A public PoC reference (a sample Nova script writing to kernel memory) is included in the GitHub advisory; it is not verified as working exploit code, there is no KEV listing, and exploitation is limited by the need for local access and the small installed base.
Privilege escalation in NovumOS versions prior to 0.24 allows local unprivileged attackers to gain kernel-level execution by manipulating core kernel structures. The vulnerable Syscall 15 (MemoryMapRange) permits user-mode processes to map arbitrary virtual memory regions, including protected kernel areas (IDT, GDT, TSS, page tables), enabling modification of interrupt handlers for privilege elevation. CISA SSVC framework confirms POC availability with total technical impact, though EPSS exploitation probability remains very low (0.01%, 2nd percentile), indicating research-phase discovery rather than widespread targeting. No CISA KEV listing at time of analysis. Vendor-released patch available in version 0.24.
Syscall 12 (JumpToUser) in NovumOS versions prior to 0.24 executes arbitrary kernel code at Ring 0 privilege when invoked by unprivileged Ring 3 user-mode processes. The vulnerability stems from missing address validation on user-supplied entry points, enabling local privilege escalation from user mode to kernel mode with complete system control. CISA SSVC framework confirms publicly available exploit code (POC status) with total technical impact, though EPSS score remains low at 0.02% (5th percentile), suggesting limited real-world targeting of this niche custom operating system despite the severe technical flaw.