Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting the Linux kernel via packet sockets

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

31–40 of 41 posts

Re: Exploiting the Linux kernel via packet sockets

#31

Post by scarybeast »

glandium wrote: post #29
dohqu8Zi wrote: post #18

Earlier quoted context omitted.

No. Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.

But you need capabilities to create that new user namespace (CAP_SYS_ADMIN, I think)

No. It's exploitable by a normal unprivileged user on modern Ubuntu. From the article, "Let’s see how we can exploit this vulnerability. I’m going to be targeting x86-64 Ubuntu 16.04.2 with 4.8.0-41-generic kernel version with KASLR, SMEP and SMAP enabled. Ubuntu kernel has user namespaces available to unprivileged users (CONFIG_USER_NS=y and no restrictions on it’s usage), so the bug can be exploited to gain root privileges by an unprivileged user."

Re: Exploiting the Linux kernel via packet sockets

#32

Post by caf »

dohqu8Zi wrote: post #18
eyalm wrote: post #14

Bottom line - locally exploitable vulnerability in the linux kernel, in case you have the CAP_NET_RAW capability which never really happens. Not a real security threat for your standard linux distro. On the other hand, this is a great technical write-up that describes thoroughly the internals of some of the linux kernel subsystems. Probably the best documentation you can find for some subsystems. Also shows how they…

No. Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.

You also need to create a network namespace, because to create an AF_PACKET socket you need to have CAP_NET_RAW in the user namespace that owns your network namespace, not the user namespace you're in.

Re: Exploiting the Linux kernel via packet sockets

#34

Post by nine_k »

_jordan wrote: post #10
Achshar wrote: post #6

I wish I was smart enough for the article. 8 years of web dev doesn't make the cut unfortunately.

yeah webapps in general are the most simple aspect of programming that you can get paid to do. Not knocking it though

Webapps use some of the highest-level tools, quite abstracted from most actual hardware.

This does not make webapps necessarily simple: complex UI logic, asynchronous everything often constant two-way communication with a server, maybe with conflict resolution, etc.

Re: Exploiting the Linux kernel via packet sockets

#35

Post by ajdlinux »

_jordan wrote: post #24
BenjiWiebe wrote: post #22

Earlier quoted context omitted.

I personally find embedded programming easier than web development...

But isn't embedded programming more complex? as in, it requires a well founded understanding of CS concepts, as well as requires advanced ability in programming and math.

I'd agree with advanced ability in programming - especially understanding things like concurrency - but probably not so much with advanced ability in maths.

(source: am kernel/firmware programmer)

Re: Exploiting the Linux kernel via packet sockets

#36

Post by SEJeff »

tyingq wrote: post #25
_jordan wrote: post #24

Earlier quoted context omitted.

But isn't embedded programming more complex? as in, it requires a well founded understanding of CS concepts, as well as requires advanced ability in programming and math.

I imagine to an embedded developer, the web just looks like madness because there's no consistency. Parachute into a web app you've never seen before, one that might not have been developed well. Your task is to make a button that's currently green and make it blue instead. What's the right file(s) to edit? How many layers of caching do you need to disable to see that your change actually worked? Do you need to resta…

Having done a bit of embedded work (I have quite a few esp8266 and esp32 dev boards programmed primarily with C and some using micropython), but also doomg a decent bit of webdev, although more server side backend than actual pure is front end...

You sir win the Internet for today.

Besides a much steeper learning curve to C, it is much easier. If you put the GPIO pull-up to high, the LED turns on. If you put it to low, the LED turns off. It is much simpler in that there isn't much abstraction really at all.

Re: Exploiting the Linux kernel via packet sockets

#37

Post by SEJeff »

_jordan wrote: post #24
BenjiWiebe wrote: post #22

Earlier quoted context omitted.

I personally find embedded programming easier than web development...

But isn't embedded programming more complex? as in, it requires a well founded understanding of CS concepts, as well as requires advanced ability in programming and math.

Not really. You can do a lot of embedded programming in C or Python or JavaScript or even Lua. You just need to be willing to not learn the next hot new framework and instead learn how the hardware underneath works. Checkout say a NodeCMU esp8266 with either JavaScript or Lua. It is a 32 bit tensillica CPU, and it is easy to learn. I didn't go to college for CS and have programmed dozens and dozens of them for fun and various IoS (internet of shit) sensors and relays.

Instead of spending ~100 for a MyQ smart garage opener I spent less than 20 for an Adafruit Huzzah and some sensors. Then I taught myself to program it and boom. It isn't hard if you're dedicated and have a project to learn with a clear bend goal.

Re: Exploiting the Linux kernel via packet sockets

#38

Post by ploxiln »

dohqu8Zi wrote: post #18
eyalm wrote: post #14

Bottom line - locally exploitable vulnerability in the linux kernel, in case you have the CAP_NET_RAW capability which never really happens. Not a real security threat for your standard linux distro. On the other hand, this is a great technical write-up that describes thoroughly the internals of some of the linux kernel subsystems. Probably the best documentation you can find for some subsystems. Also shows how they…

No. Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.

Right, but "unprivileged user namespaces" are disabled in many contexts, because they've been a source of many vulnerabilities due to code originally thought to only be reachable by root anyway.

Archlinux has user namespaces disabled, docker does not use them by default and does not allow them inside containers by default, on Ubuntu I make sure to disable kernel.unprivileged_userns_clone on all the servers I deploy to, etc.

Re: Exploiting the Linux kernel via packet sockets

#39

Post by dohqu8Zi »

wrongmmmm wrote: post #27
dohqu8Zi wrote: post #20

Earlier quoted context omitted.

No, Docker usually drops CAP_NET_RAW within the container. But you can change that and other container technologies definitely keep CAP_NET_RAW within the container.

Not true. CAP_NET_RAW is on by default: https://github.com/moby/moby/blob/master/oci/defaults_linux.... Otherwise no one could ping from a container.

Thanks for the correction.
Post reply on HN