Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Most serious” Linux privilege-escalation bug ever is under active exploit

arstechnica.com

Post reply on HN
Print view View original

91–100 of 218 posts

Re: “Most serious” Linux privilege-escalation bug ever is under active exploit

#91

Post by tptacek »

timtadh wrote: post #40
tptacek wrote: post #24

Earlier quoted context omitted.

Those people might be right. Defense in depth is a legitimate tactic, but that's all it is, and it's often an excuse for people to waste time layering stupid stuff on top of real security controls. ASLR, NX, and CFI would be an example of a defense in depth stack that is meaningful. SSH, Fail2Ban, and SPA would be an example of a defense in depth stack that basically just wastes time. I would be more comfortable with…

I'm confused, how is SSH an example of defense in depth? It is an access method. You should absolutely harden your SSH configuration. Fail2Ban is useless on a properly configured SSH server (no root, no passwords, no kerberos, only keys). Managing the keys at scale, well that is a different story. I agree with you that ASLR, NX, and CFI are the most important system level defenses to employ.

SSH is fine. Stacking extra stuff on top of SSH to create a defense-in-depth stack for it SSH is what's silly. Just disable passwords and use SSH.

Re: “Most serious” Linux privilege-escalation bug ever is under active exploit

#92

Post by tptacek »

ams6110 wrote: post #43
tcoppi wrote: post #16

Earlier quoted context omitted.

> 2. In almost all cases, whether or not there's a known local privesc bug, assume that code execution on your Linux systems equates to privesc; this is doubly true of machines in your prod deployment environment. I think this goes for any mainstream OS, Linux is not particularly special here.

So basically, if you wouldn't give a user sudo, they shouldn't have login access at all? Certainly works for some scenarios, but not practical for many others.

Correct.

Re: “Most serious” Linux privilege-escalation bug ever is under active exploit

#93

Post by TheSpiceIsLife »

0942v8653 wrote: post #85
hossbeast wrote: post #61

Earlier quoted context omitted.

A link would be appreciated. The text is truncated at N columns on mobile.

https://github.com/dirtycow/dirtycow.github.io/wiki/Vulnerab... and scroll up a bit. If you have an iPhone you can scroll horizontally even if it doesn't look like you can (though I am also annoyed by HN truncating the text)

The solution is for people to stop using blockquote formatting for text and reserve it for it's intended puprose of quoting code and retaining formatting.

Re: “Most serious” Linux privilege-escalation bug ever is under active exploit

#95

Post by ndesaulniers »

ontoillogical wrote: post #58

At Appcanary, we're thinking about opening up our vulnerability database to be browsable and searchable by the public. If you're not sure which version has the patch for this vulnerability in your distro, here's what we know: Ubuntu - https://appcanary.com/vulns/45984 Debian - https://appcanary.com/vulns/45983 Amazon Linux - https://appcanary.com/vulns/45992 Centos - no patch yet If you found this useful, please let…

Do you keep track of Android releases?

edit: https://appcanary.com/vulns made my browser crawl. Please fix that page.

Re: “Most serious” Linux privilege-escalation bug ever is under active exploit

#96

Post by tekacs »

flukus wrote: post #84
the_duke wrote: post #7

Seems to be fixed by this commit (in 4.8.3). commit 89eeba1594ac641a30b91942961e80fae978f839 Author: Linus Torvalds Date: Thu Oct 13 13:07:36 2016 -0700 mm: remove gup_flags FOLL_WRITE games from __get_user_pages() commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 upstream. This is an ancient bug that was actually attempted to be fixed once (badly) by me eleven years ago in commit 4ceb5db9757a ("Fix get_user_pages() ra…

So it's been a known bug for 11 years? That sounds like a pretty serious issue with the QA and or bug tracking process.

Yup: http://arstechnica.co.uk/security/2016/09/linux-kernel-secur...

Re: “Most serious” Linux privilege-escalation bug ever is under active exploit

#97

Post by i336_ »

qwertyuiop924 wrote: post #65
xzion wrote: post #38

Earlier quoted context omitted.

Looking forward to a followup talk of him gloating now this bug has been reported

I genuinely doubt he'll notice. Bryan, if you're reading this, it's merely because I doubt that you actually check Linux bugtrackers. Also, GNU tail provides tail -F, which does what you want tail -f to do. There is a reason for this. I don't remember what it is, but I think the manpage talks about it.

-F vs -f: -F figures out the new inode if the file is deleted (*notify are inode-based, if you see DELETE_SELF for a file you'll never get any more events)

Re: “Most serious” Linux privilege-escalation bug ever is under active exploit

#98

Post by forbiddenlake »

winter_blue wrote: post #76
justinsaccount wrote: post #70

Earlier quoted context omitted.

..because you don't know the difference between upgrade and dist-upgrade. use dist-upgrade or just explicitly install those packages.

No, dist-upgrade would be 14.04 -> 16.04. I don't want 16.04; I want to stay on 14.04.

Sorry, instead of "upgrade" I should have typed `full-upgrade` (which is the same thing as `dist-upgrade` and is unrelated to moving major distro versions)

Re: “Most serious” Linux privilege-escalation bug ever is under active exploit

#99

Post by microcolonel »

ndesaulniers wrote: post #95
ontoillogical wrote: post #58

At Appcanary, we're thinking about opening up our vulnerability database to be browsable and searchable by the public. If you're not sure which version has the patch for this vulnerability in your distro, here's what we know: Ubuntu - https://appcanary.com/vulns/45984 Debian - https://appcanary.com/vulns/45983 Amazon Linux - https://appcanary.com/vulns/45992 Centos - no patch yet If you found this useful, please let…

Do you keep track of Android releases? edit: https://appcanary.com/vulns made my browser crawl. Please fix that page.

I think you just need more RAM, it's convenient having it all on one page instead of paginated.

Re: “Most serious” Linux privilege-escalation bug ever is under active exploit

#100

Post by ontoillogical »

ndesaulniers wrote: post #95
ontoillogical wrote: post #58

At Appcanary, we're thinking about opening up our vulnerability database to be browsable and searchable by the public. If you're not sure which version has the patch for this vulnerability in your distro, here's what we know: Ubuntu - https://appcanary.com/vulns/45984 Debian - https://appcanary.com/vulns/45983 Amazon Linux - https://appcanary.com/vulns/45992 Centos - no patch yet If you found this useful, please let…

Do you keep track of Android releases? edit: https://appcanary.com/vulns made my browser crawl. Please fix that page.

Re Android: No we don't, but I'd be interested to know what we can do with Android to be helpful to you. Send me an email (max at our domain) if you want to talk more.

vulns page: yeesh that is slow. This is the first time I'm sharing our vuln pages outside of our logged-in users, and yeah, that index is definitely not ready for public consumption yet.

Post reply on HN