Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

github.com

Post reply on HN
Print view View original

31–40 of 43 posts

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#31

Post by jelly »

vmception wrote: post #26

Been waiting for a WSL thread. Does WSL have a performance hit on Windows 10? I sometimes can't decide if I want to use a familiar linux version of a program or a Windows version, but I like how WSL lets you access the windows file system

In my experience there's a performance hit in filesystem-heavy work like opening and closing a lot of small files.

Still, its more than offset by the convenience of performing bash operations on Windows; remembering `du -csh ./* | sort -h` (sort directories by size) is easier than whatever Powershell would have me type.

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#32

Post by [deleted] »

invokestatic wrote: post #25

This page has critical misinformation which has already caused confusion on this thread. Version number alone cannot tell you if you are vulnerable or patched! Many, many Linux distributions, including (at least) Ubuntu and RHEL "backport" security fixes to older versions of the software. That means you could be using an old version of sudo, but still fully patched and protected from this exploit. Edit: furthermore,…

[deleted]

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#34

Post by mcrump »

invokestatic wrote: post #25

This page has critical misinformation which has already caused confusion on this thread. Version number alone cannot tell you if you are vulnerable or patched! Many, many Linux distributions, including (at least) Ubuntu and RHEL "backport" security fixes to older versions of the software. That means you could be using an old version of sudo, but still fully patched and protected from this exploit. Edit: furthermore,…

Very good point and I've updated the README.md. I had a typo when I originally ran it and that is why I thought you had to update it manually. Thanks community for helping me.

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#35

Post by mcrump »

shawnz wrote: post #14
mcrump wrote: post #10

Earlier quoted context omitted.

I noticed that I had a typo in my command. -- original comment You can run it but it doesn't find anything. https://www.youtube.com/watch?v=iRIXXUNkgAM&t=1244s

I think you accidentally typoed the first command "apt-get update" as "apt-get upgrade", which is why it didn't work there.

Correct! Thank you!

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#36

Post by tyingq »

vmception wrote: post #26

Been waiting for a WSL thread. Does WSL have a performance hit on Windows 10? I sometimes can't decide if I want to use a familiar linux version of a program or a Windows version, but I like how WSL lets you access the windows file system

There's WSL1 and WSL2. Both have areas where performance isn't great, but the areas are different for each. Most of the issues are filesystem related, especially cross Win/Linux.

Try a 'git clone' of a reasonably large remote repo to see what it's like. Into both the windows fs and the Linux one.

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#37

Post by YurtyAherne »

xorcist wrote: post #29
YurtyAherne wrote: post #27

If anyone needs to patch CentOS 6 like I had to (I know, I know..), it's possible. You'll need to install gcc, pam-devel and openldap-devel if you need it. Then you can build from source using ./configure --prefix=/usr && make && make install Oh and remember to switch your repos to CentOS Vault instead of the default mirrorlist if you need the packages mentioned above.

Normally you should use the source packages available to you. If you run configure and make on the upstream package, you will not only lose the patches CentOS normally applies to the package to integrate it better with the system, but your patch will also be untracked by the package manager. Building a source package is trivial. Just download the srpm, run rpm -i just like you normally would. This will extract the pa…

Not sure what you're on about. CentOS 6 doesn't receive updates anymore. It's EOL. Why go through all that effort if nothing will ever replace the package I compiled from source and installed?

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#38

Post by aaron695 »

Related - I would have thought more people than were, would have been interested in this thread about how 'obvious' this exploit was -

https://news.ycombinator.com/item?id=25950976

How long it would have taken to fuzz recent buffer overflow in sudo? https://milek7.pl/howlongsudofuzz/

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#39

Post by vmception »

tyingq wrote: post #36
vmception wrote: post #26

Been waiting for a WSL thread. Does WSL have a performance hit on Windows 10? I sometimes can't decide if I want to use a familiar linux version of a program or a Windows version, but I like how WSL lets you access the windows file system

There's WSL1 and WSL2. Both have areas where performance isn't great, but the areas are different for each. Most of the issues are filesystem related, especially cross Win/Linux. Try a 'git clone' of a reasonably large remote repo to see what it's like. Into both the windows fs and the Linux one.

WSL2 is what I’m wondering about

Should I submit hashes with geth linux on wsl2 or geth windows native

I guess I could just benchmark it, havent gotten around to it.

Re: Sudo buffer overflow explained, and how to patch (WSL and Linux) [video]

#40

Post by brohee »

jonnytran wrote: post #28
bonyt wrote: post #4

macOS doesn't have sudoedit, but you can make a symlink to it, as sudo is effectively a multi-call binary: ln -s `which sudo` sudoedit and then call it: ./sudoedit So don't take the lack of a `sudoedit` command as evidence that a system isn't vulnerable. I don't know if the sudo included with macOS has been exploited though.

What is the simplest way to upgrade on macOS?

No simple way because Apple is sitting on its ass.
Post reply on HN