Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dirty Frag: Universal Linux LPE

openwall.com

Post reply on HN
Print view View original

31–40 of 370 posts

Re: Dirty Frag: Universal Linux LPE

#31

Post by formerly_proven »

firer wrote: post #18

This is very similar in root cause and exploitation to Copy Fail. Which illustrates pretty well something that's lost when relying heavily on LLMs to do work for you: exploration. I find that doing vulnerability research using AI really hinders my creativity. When your workflow consists of asking questions and getting answers immediately, you don't get to see what's nearby. It's like a genie - you get exactly what yo…

These are all page cache poisoning attacks (dirtyfrag, copyfail, dirtypipe). Maybe the page cache should have defense-in-depth measures for SUID binaries?

Re: Dirty Frag: Universal Linux LPE

#32

Post by firer »

formerly_proven wrote: post #31
firer wrote: post #18

This is very similar in root cause and exploitation to Copy Fail. Which illustrates pretty well something that's lost when relying heavily on LLMs to do work for you: exploration. I find that doing vulnerability research using AI really hinders my creativity. When your workflow consists of asking questions and getting answers immediately, you don't get to see what's nearby. It's like a genie - you get exactly what yo…

These are all page cache poisoning attacks (dirtyfrag, copyfail, dirtypipe). Maybe the page cache should have defense-in-depth measures for SUID binaries?

SUID mitigations have nothing to do with the vulnerability itself - just the exploit.

If there's a root cronjob that runs a world readable binary, you could modify it in the page cache and exploit it that way.

Modifying the page cache is a really strong primitive with countless ways to exploit it.

Re: Dirty Frag: Universal Linux LPE

#36

Post by wolttam »

xxpor wrote: post #30

Linux is a single user system and should be treated as such. Run your services as root. Don't rely on unix user primitives for security.

Running as root opens you up to a class of vulnerabilities (denial of service, mainly) that you can avoid by not running as root.

That said, running every process in its own micro VM is looking more attractive by the minute.

Re: Dirty Frag: Universal Linux LPE

#38

Post by jacobgkau »

john_strinlai wrote: post #15
int0x29 wrote: post #13

I'm curious what broke the embargo. Did it leak or did a third party find it independently?

it was published publicly by an unrelated third party

They're asking the nature of the third party's discovery/publishing. Someone on the inside who decided to leak it anonymously? Someone else who was able to access some private communication they shouldn't have been able to see? Or a third party who happened to discover the same vulnerability (which seems less unlikely than normal since this is so similar to Copy Fail), but didn't follow disclosure procedures?

Re: Dirty Frag: Universal Linux LPE

#39

Post by john_strinlai »

ftheplan9 wrote: post #35

[flagged]

>2026-05-07: After obtaining agreement from distribution maintainers to fully disclose Dirty Frag, the entire Dirty Frag document was published.

you think the reporters and the distribution maintainers colluded to... get 5 minutes of attention?

that would be exceptionally stupid of the distribution maintainers and destroy all trust.

Re: Dirty Frag: Universal Linux LPE

#40

Post by tptacek »

firer wrote: post #18

This is very similar in root cause and exploitation to Copy Fail. Which illustrates pretty well something that's lost when relying heavily on LLMs to do work for you: exploration. I find that doing vulnerability research using AI really hinders my creativity. When your workflow consists of asking questions and getting answers immediately, you don't get to see what's nearby. It's like a genie - you get exactly what yo…

I don't follow. LLMs spotted these bugs in the first place. You seem to be saying that these discoveries are indications that they're bad for vulnerability discovery.
Post reply on HN