[flagged]
You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
31–40 of 152 posts
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#32> “and is writable with CAP_SYS_ADMIN” Am I reading this wrong or is this just a way of executing an arbitrary binary with uid=0 if you have both CAP_NET_ADMIN and CAP_SYS_ADMIN? If you can write modprobe_path, is it really news that you can find a way to execute code?
No, you can grant yourself this inside an unprivileged user namespace. `unshare -Ur capsh --print` lists the capabilities inside a user namespace and demonstrates that it has both CAP_SYS_ADMIN and CAP_NET_ADMIN.
Almost all distros allow unprivileged user namespaces, and in my opinion this is the right decision, because they're important for browser sandboxing which I think is more important than LPEs.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#33Do most servers need this? Or can most of us 'sysctl -w kernel.io_uring_disabled=2
' ?
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#34[flagged]
Obviously the way to prevent this is by bounds checking, which is literally in the `770594e` patch. It's just a bug and they happen routinely in all languages. Since this is doing pointer arithmetic, it could just as easily happen in unsafe Rust, for example.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#35Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#36[flagged]
Obviously the way to prevent this is by bounds checking, which is literally in the `770594e` patch. It's just a bug and they happen routinely in all languages. Since this is doing pointer arithmetic, it could just as easily happen in unsafe Rust, for example.
Like they said, "no way to prevent this" (kind of bug from happening again).
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#37Earlier quoted context omitted.
Obviously the way to prevent this is by bounds checking, which is literally in the `770594e` patch. It's just a bug and they happen routinely in all languages. Since this is doing pointer arithmetic, it could just as easily happen in unsafe Rust, for example.
Like they said, "no way to prevent this" (kind of bug from happening again).
Static analysis and other tools can find this, but they're expensive; wonder what the kernel team has access to?
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#38Earlier quoted context omitted.
Like they said, "no way to prevent this" (kind of bug from happening again).
Static analysis and other tools can find this, but they're expensive; wonder what the kernel team has access to?
Technically, the kernel team is sufficiently competent to design and build bespoke tools for themselves. It‘s probably a question of risk assessment and priorities.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#39Earlier quoted context omitted.
Like they said, "no way to prevent this" (kind of bug from happening again).
Static analysis and other tools can find this, but they're expensive; wonder what the kernel team has access to?
If static analysis could actually find these issues with a reasonable false positive rate, the companies behind them would be running them on Linux to get the publicity of having found the issues like all the AI companies are doing now. Imo the good static analysis heuristics are already built into compilers or in open source linters.
Re: You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
#40CAP_NET/SYS_ADMIN is required for this. So this would be "not as bad" as the others.
It could work for container escape?