Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

ze3tar.github.io

Post reply on HN
Print view View original

21–30 of 152 posts

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#21

Post by stonegray »

> “and is writable with CAP_SYS_ADMIN”

Am I reading this wrong or is this just a way of executing an arbitrary binary with uid=0 if you have both CAP_NET_ADMIN and CAP_SYS_ADMIN?

If you can write modprobe_path, is it really news that you can find a way to execute code?

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#22

Post by mschuster91 »

cachius wrote: post #8
EGreg wrote: post #4

Earlier quoted context omitted.

How's BSD doing? How about Amazon Linux?

And Windows?

Pray to God no one ever lets an AI agent run loose on the various leaked Windows source code dumps.

Given Windows' absurd amount of backwards compatibility, chances are pretty high that there are a lot of sleeping dragons buried inside even modern Windows 10/11 kernel and userland that date back to code and issues from the 90s - code where half the people who have worked on it probably not just have departed Microsoft but departed living in the meantime.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#23

Post by pizzalife »

stonegray wrote: post #21

> “and is writable with CAP_SYS_ADMIN” Am I reading this wrong or is this just a way of executing an arbitrary binary with uid=0 if you have both CAP_NET_ADMIN and CAP_SYS_ADMIN? If you can write modprobe_path, is it really news that you can find a way to execute code?

Right. `CAP_SYS_ADMIN` is for all intents and purposes equivalent to root.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#24

Post by yjftsjthsd-h »

EGreg wrote: post #4
rvz wrote: post #2

Another one. Linux is falling apart faster than it can assign these CVEs.

How's BSD doing? How about Amazon Linux?

Amazon Linux is a Linux distro? Though, yes, I would like to know how the BSDs are doing.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#26

Post by yjftsjthsd-h »

ChocolateGod wrote: post #14
maven29 wrote: post #12

Earlier quoted context omitted.

perhaps this will lead to better AppArmor and SELinux defaults?

People will just turn SELinux off rather than have to go through the horrible tooling when it breaks a regular use case.

I do think SELinux is a good example of how robust software with poor UX/DX gets undermined by that poor UX/DX. Although I do wonder if AI can help with it?

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#27

Post by otterley »

staticassertion wrote: post #3

io-uring is a security nightmare. Constant privescs and a powerful primitive for syscall smuggling. Worth considering disabling it outright (already the case for most containers afaik).

At one point, Google disabled io_uring on its production servers (https://security.googleblog.com/2023/06/learnings-from-kctf-...) - I don't know whether this is still true, though. Perhaps a Google can confirm.

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#28

Post by otterley »

yjftsjthsd-h wrote: post #24
EGreg wrote: post #4

Earlier quoted context omitted.

How's BSD doing? How about Amazon Linux?

Amazon Linux is a Linux distro? Though, yes, I would like to know how the BSDs are doing.

Yes, it's a fork of Fedora. https://docs.aws.amazon.com/linux/al2023/ug/what-is-amazon-l...

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#29

Post by vsgherzi »

otterley wrote: post #27
staticassertion wrote: post #3

io-uring is a security nightmare. Constant privescs and a powerful primitive for syscall smuggling. Worth considering disabling it outright (already the case for most containers afaik).

At one point, Google disabled io_uring on its production servers ( https://security.googleblog.com/2023/06/learnings-from-kctf-... ) - I don't know whether this is still true, though. Perhaps a Google can confirm.

super curious on this one as well, last I heard they've been enabling it slowly

Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

#30

Post by pixl97 »

gilrain wrote: post #10
rishabhaiover wrote: post #5

What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.

Automated vulnerability discovery via LLM.

Everyone was talking about how Mythos was overblown marketing, and while it may be, they missed the forest for the trees. Capabilities have been escalating for a year now and we're at the point of widespread impact. I don't suspect we'll see a slowdown for a long time.
Post reply on HN