Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting the Linux kernel via packet sockets

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Exploiting the Linux kernel via packet sockets

#11

Post by Achshar »

tyingq wrote: post #9
Achshar wrote: post #6

I wish I was smart enough for the article. 8 years of web dev doesn't make the cut unfortunately.

It's just domain knowledge and terminology. "Packet sockets" is shorthand for the AF_PACKET type sockets in Linux that let you construct network packets from the ground up, including the ethernet header, if you so wish. That's as opposed to a regular socket, which is higher level and restricts you to a much smaller subset of things you can change/set. The article just shows how they uncovered an exploit by "fuzzing"…

The concept I think I can still get my head around. It's all the stuff that surrounds it that eludes me. I have done some work in C but that C is unlike any of the C I wrote in college (duh, it's the kernel code)

Re: Exploiting the Linux kernel via packet sockets

#12

Post by fencepost »

Someone correct me if I'm wrong:

This is a locally exploitable privilege escalation involving creation of the socket, triggerable from user level, so exploitable by local users or as a followup after another exploit is used to get some level of local access, correct?

Re: Exploiting the Linux kernel via packet sockets

#13

Post by tyingq »

Achshar wrote: post #11
tyingq wrote: post #9

Earlier quoted context omitted.

It's just domain knowledge and terminology. "Packet sockets" is shorthand for the AF_PACKET type sockets in Linux that let you construct network packets from the ground up, including the ethernet header, if you so wish. That's as opposed to a regular socket, which is higher level and restricts you to a much smaller subset of things you can change/set. The article just shows how they uncovered an exploit by "fuzzing"…

The concept I think I can still get my head around. It's all the stuff that surrounds it that eludes me. I have done some work in C but that C is unlike any of the C I wrote in college (duh, it's the kernel code)

I don't see what you mean. It's a long line, so it breaks across 3 lines, but otherwise, it's just:

if (a >= b && (int)(c - MACRO(d)) Or the stuff further down? Just confusing because tpacket_req and friends are defined as structs elsewhere, so you don't have that context. And it's not really C, it's syzkaller (fuzzing tool) descriptions, kind of a pseudo code syntax.

Re: Exploiting the Linux kernel via packet sockets

#14

Post by eyalm »

Bottom line - locally exploitable vulnerability in the linux kernel, in case you have the CAP_NET_RAW capability which never really happens. Not a real security threat for your standard linux distro.

On the other hand, this is a great technical write-up that describes thoroughly the internals of some of the linux kernel subsystems. Probably the best documentation you can find for some subsystems. Also shows how they bypassed exploit mitigations technics such as KASLR, SMAP&SMEP.

Re: Exploiting the Linux kernel via packet sockets

#15

Post by yeukhon »

_jordan wrote: post #10
Achshar wrote: post #6

I wish I was smart enough for the article. 8 years of web dev doesn't make the cut unfortunately.

yeah webapps in general are the most simple aspect of programming that you can get paid to do. Not knocking it though

(and I can't do any frontend work). Every job has its own difficulties and its own obstacles.

off-topic, btw, I read tpacket == tptacek. He can easily hide in Linux kernel. No one noticed, until now.

Re: Exploiting the Linux kernel via packet sockets

#16

Post by eyalm »

fencepost wrote: post #12

Someone correct me if I'm wrong: This is a locally exploitable privilege escalation involving creation of the socket, triggerable from user level, so exploitable by local users or as a followup after another exploit is used to get some level of local access, correct?

Not really. Requires to have the CAP_NET_RAW capability, which is pretty rare. (This capability allows you raw access to the network interface, which is usually only given to the root user)

Re: Exploiting the Linux kernel via packet sockets

#17

Post by dom0 »

AnimalMuppet wrote: post #3
googsh0tz wrote: post #2

You know, like I said the intel thing.

I don't think this is related to the Intel thing at all. It's not technically related, and it's not related in terms of severity.

Either has headlines made of words, so that's something.

Re: Exploiting the Linux kernel via packet sockets

#18

Post by dohqu8Zi »

eyalm wrote: post #14

Bottom line - locally exploitable vulnerability in the linux kernel, in case you have the CAP_NET_RAW capability which never really happens. Not a real security threat for your standard linux distro. On the other hand, this is a great technical write-up that describes thoroughly the internals of some of the linux kernel subsystems. Probably the best documentation you can find for some subsystems. Also shows how they…

No.

Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.

Re: Exploiting the Linux kernel via packet sockets

#19

Post by d33 »

dohqu8Zi wrote: post #18
eyalm wrote: post #14

Bottom line - locally exploitable vulnerability in the linux kernel, in case you have the CAP_NET_RAW capability which never really happens. Not a real security threat for your standard linux distro. On the other hand, this is a great technical write-up that describes thoroughly the internals of some of the linux kernel subsystems. Probably the best documentation you can find for some subsystems. Also shows how they…

No. Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.

That's pretty interesting. Does it mean it allows escaping Docker containers if you compromise a service ran as root in it?

Re: Exploiting the Linux kernel via packet sockets

#20

Post by dohqu8Zi »

d33 wrote: post #19
dohqu8Zi wrote: post #18

Earlier quoted context omitted.

No. Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.

That's pretty interesting. Does it mean it allows escaping Docker containers if you compromise a service ran as root in it?

No, Docker usually drops CAP_NET_RAW within the container. But you can change that and other container technologies definitely keep CAP_NET_RAW within the container.
Post reply on HN