Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dirty Frag: Universal Linux LPE

openwall.com

Post reply on HN
Print view View original

61–70 of 370 posts

Re: Dirty Frag: Universal Linux LPE

#61

Post by lights0123 »

synack wrote: post #48
oncallthrow wrote: post #17

can this also be used to obtain container escape ?

If your container has setuid binaries and these modules are loaded, yes.

With the exploits published as-is, you'll only get root inside the container: there's no explicit namespace break, and calling setuid() in a container just gives you root in the container.

However, it can be used to modify files that are passed into the container (e.g. Docker run -v), or files that are shared with other containers (e.g. other Docker containers sharing the same layers). kube-proxy with Kubernetes happens to share a trusted binary with containers by default, which is how it can be exploited: https://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kuber...

Re: Dirty Frag: Universal Linux LPE

#62

Post by ahartmetz »

staticassertion wrote: post #42
jacobgkau wrote: post #38

Earlier quoted context omitted.

They're asking the nature of the third party's discovery/publishing. Someone on the inside who decided to leak it anonymously? Someone else who was able to access some private communication they shouldn't have been able to see? Or a third party who happened to discover the same vulnerability (which seems less unlikely than normal since this is so similar to Copy Fail), but didn't follow disclosure procedures?

The commit for the fix was public. Someone noticed. An exploit was published.

I think I read on the bug's website that "No fix has been released". I understood that as there is no public fix, but maybe it only means it's not in a tagged version of the kernel and no hotfixed distro kernels have been released?

Re: Dirty Frag: Universal Linux LPE

#63

Post by mike_d »

progval wrote: post #59
bawolff wrote: post #22

Earlier quoted context omitted.

Its not the reporter's fault that other people broke the embargo.

They don't have to publish a working exploit as soon as the embargo is broken, though.

Why not? There has already been a working exploit floating around, at least now it comes from an authoritative source.

Re: Dirty Frag: Universal Linux LPE

#64

Post by parliament32 »

tptacek wrote: post #40
firer wrote: post #18

This is very similar in root cause and exploitation to Copy Fail. Which illustrates pretty well something that's lost when relying heavily on LLMs to do work for you: exploration. I find that doing vulnerability research using AI really hinders my creativity. When your workflow consists of asking questions and getting answers immediately, you don't get to see what's nearby. It's like a genie - you get exactly what yo…

I don't follow. LLMs spotted these bugs in the first place . You seem to be saying that these discoveries are indications that they're bad for vulnerability discovery.

No, they did not. Careful of falling for the psychosis.

> This finding was AI-assisted, but began with an insight from Theori researcher Taeyang Lee, who was studying how the Linux crypto subsystem interacts with page-cache-backed data.

https://xint.io/blog/copy-fail-linux-distributions

Re: Dirty Frag: Universal Linux LPE

#65

Post by dundarious »

john_strinlai wrote: post #3

"Because the embargo has now been broken, no patches or CVEs exist for these vulnerabilities." link: https://github.com/V4bel/dirtyfrag detailed writeup: https://github.com/V4bel/dirtyfrag/blob/master/assets/write-... importantly: " Copy Fail was the motivation for starting this research. In particular, xfrm-ESP Page-Cache Write in the Dirty Frag vulnerability chain shares the same sink as Copy Fail. However, it is t…

You can't sudo echo and redirect from the non-sudo shell like that.

    echo 3 | sudo tee /proc/sys/vm/drop_caches
or

    sudo sh -c 'echo 3 > /proc/sys/vm/drop_caches'
Also fixed your typo in /proc...

Re: Dirty Frag: Universal Linux LPE

#66

Post by arian_ »

Every time someone finds a universal Linux privilege escalation, somewhere a sysadmin whispers 'this is why we don't run as root' while nervously checking if their containers are actually isolated.

Re: Dirty Frag: Universal Linux LPE

#67

Post by john_strinlai »

progval wrote: post #59
bawolff wrote: post #22

Earlier quoted context omitted.

Its not the reporter's fault that other people broke the embargo.

They don't have to publish a working exploit as soon as the embargo is broken, though.

anyone who will use the exploit maliciously will immediately and trivially be able to create a working exploit.

Re: Dirty Frag: Universal Linux LPE

#68

Post by ahartmetz »

unethical_ban wrote: post #12

Here's a general question, are these vulnerabilities hitting Linux more than BSDs due to hit being a larger target or because its architecture is less secure by design?

AFAIU, Linux and the BSDs have basically the same architecture - the BSDs just value secure and simple, understandable code more highly than Linux vs features and performance.

Re: Dirty Frag: Universal Linux LPE

#69

Post by Sohcahtoa82 »

xxpor wrote: post #30

Linux is a single user system and should be treated as such. Run your services as root. Don't rely on unix user primitives for security.

This carries the same energy as "People will break into your car no matter what, so just leave your doors unlocked."
Post reply on HN