Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dirty Frag: Universal Linux LPE

openwall.com

Post reply on HN
Print view View original

281–290 of 370 posts

Re: Dirty Frag: Universal Linux LPE

#281

Post by dotancohen »

timcobb wrote: post #230
firer wrote: post #18

This is very similar in root cause and exploitation to Copy Fail. Which illustrates pretty well something that's lost when relying heavily on LLMs to do work for you: exploration. I find that doing vulnerability research using AI really hinders my creativity. When your workflow consists of asking questions and getting answers immediately, you don't get to see what's nearby. It's like a genie - you get exactly what yo…

> When your workflow consists of asking questions and getting answers immediately, you don't get to see what's nearby. Very much aligns with my experience. For me this is the most unsatisfying thing about AI-based workflows in general, they miss stuff humans would never miss. All the time I wonder what am I missing that's right nearby? It's remarkable how many times I have to ask Claude code to fully ingest something…

  > All the time I wonder what am I missing that's right nearby?
Add to the prompt "use coding conventions of the file which you are currently editing". That gets the machine (Opus and Sonnet at least) to go over the nearby code and occasionally mention something obvious.

Re: Dirty Frag: Universal Linux LPE

#282

Post by [deleted] »

chromacity wrote: post #85

If this indeed works on all major distributions, I just continue to be amazed by how irresponsible the maintainers are. We're talking about optional kernel functionality that's presumably useful to something like This feels like the practice of Linux distros back in 1999 when they'd ship default installs with dozens of network services exposed to the internet. Except it's not 1999 anymore.

[deleted]

Re: Dirty Frag: Universal Linux LPE

#283

Post by yread »

baq wrote: post #258
tempaccount5050 wrote: post #231

Earlier quoted context omitted.

I haven't updated mine. I have a firewall and it's not exposed to the Internet. Need a key to SSH in. Same with my public facing server. Almost none of these exploits are "drop everything now and patch" unless you are somehow exposing yourself stupidly.

If you’re running any sort of CI you’re probably going to have a bad couple of days if everything goes well

unless you run pinned CI runners on hardware you control

Re: Dirty Frag: Universal Linux LPE

#284

Post by rithdmc »

tempaccount5050 wrote: post #231
thom wrote: post #170

After all these years, we finally have enough eyeballs that all bugs are shallow, and it kinda sucks. How many times a week am I going to be updating my kernel from now on?

I haven't updated mine. I have a firewall and it's not exposed to the Internet. Need a key to SSH in. Same with my public facing server. Almost none of these exploits are "drop everything now and patch" unless you are somehow exposing yourself stupidly.

> unless you are somehow exposing yourself stupidly

Or, y'know, offer some forms of compute as a service.

Re: Dirty Frag: Universal Linux LPE

#285

Post by Luker88 »

I can't make it work on nixos. Kernel 7.0.1

I tried fixing the paths and even linking `/bin/bash` to the nix /run/current-system/sw/bin/bash

/etc/passwd is unmodified.

Can anyone else try? CopyFail1 did not work because `su` is only executable, not readable, CopyFail2 worked only partially (changes /etc/passwd but the user is not passwordless)

Re: Dirty Frag: Universal Linux LPE

#286

Post by croes »

akimbostrawman wrote: post #271
croes wrote: post #262

Earlier quoted context omitted.

Is it? The claim is Android is much more secure than other Linux, but if 40% of all Android devices don‘t get a security patch and you can’t even do it yourself I would call the more secure per se. Hardening is one part of security, patchability another. Android lacks in the latter.

>if 40% of all Android devices don‘t get a security patch No system will stay secure once it does not receive updates. That does not exclude it from being more secure than another system based on security feature merits as long as it does get updated. >Hardening is one part of security, patchability another. Android lacks in the latter. That is not an inherent flaw with android but OEM devices shipping modified andro…

It is an inherent flaw of android. Imagine no Windows update because Lenovo stopped support for 4 year old notebooks

Re: Dirty Frag: Universal Linux LPE

#287

Post by account42 »

reisse wrote: post #153
int0x29 wrote: post #13

I'm curious what broke the embargo. Did it leak or did a third party find it independently?

No embargo exists (or could possibly exist) in the first place. Linux is open source, so every patch fixing the security bug is immediately visible to everyone. There is no workaround to that by the very design how the kernel is developed. The "embargo" people talking about is the rather stupid notion that if people keep their mouth shut and not write "THIS IS A LPE" straight in the patch description, everyone can pr…

The linked announcement specifically mentions that an embargo has been broken.

Re: Dirty Frag: Universal Linux LPE

#288

Post by quantummagic »

delamon wrote: post #278
minimaltom wrote: post #106

Earlier quoted context omitted.

This attack class lets you escalate from any user to UID 0. Not running as root won't save you, in fact, this attack is for those processes not running as root. However, if you are in a user namespace where UID 0 doesn't map to system-wide capabilities, and you dont share page cache for the setuid binaries on the system, this attack doesn't lead to LPE.

setuid binaries are not the only way to get root. E.g. one can change /etc/crontab or /etc/passwd. Or add trojan to /bin/ls and wait until admin type 'ls'

It's not always as easy as you imply. All the attack vectors you mentioned, require root on the host, before you can make the change or install the trojan.

Re: Dirty Frag: Universal Linux LPE

#290

Post by alecco »

sounds wrote: post #215
john_strinlai wrote: post #3

"Because the embargo has now been broken, no patches or CVEs exist for these vulnerabilities." link: https://github.com/V4bel/dirtyfrag detailed writeup: https://github.com/V4bel/dirtyfrag/blob/master/assets/write-... importantly: " Copy Fail was the motivation for starting this research. In particular, xfrm-ESP Page-Cache Write in the Dirty Frag vulnerability chain shares the same sink as Copy Fail. However, it is t…

Is there any additional info on where it was "published publicly by an unrelated third party"? From the timeline in the writeup: > 2026-05-07: Submitted detailed information about the vulnerability and the exploit to the linux-distros mailing list. The embargo was set to 5 days, with an agreement that if a third party publishes the exploit on the internet during the embargo period, the Dirty Frag exploit would be pub…

People are blaming the guy who wrote the exploit for breaking the embargo but it was actually broken in Linux by publishing a fix [1]:

> on 2026-05-05 Steffen Klassert pushed f4c50a4034 to netdev/net.git with Cc: stable@vger.kernel.org.

Once a fix is out it's usual for researchers to race to make the first exploit out of it.

[1] https://afflicted.sh/blog/posts/copy-fail-2.html

Post reply on HN