Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dirty Frag: Universal Linux LPE

openwall.com

Post reply on HN
Print view View original

351–360 of 370 posts

Re: Dirty Frag: Universal Linux LPE

#351

Post by fulafel »

YZF wrote: post #235
fulafel wrote: post #234

Both of these (copy fail and dirtyfrag) exploit obscure socket address families. Are these filtered by commonly used seccomp profiles in eg docker (assuming seccomp can express it)?

At least in the k8s setup I looked at the dirtyfrag were filtered (by default). "XFRM SA registration requires CAP_NET_ADMIN".

Right, so it blocked the first part of the chain. Which normally uses unprivilgeed network namespace to dp net admin inside that.

I had been thinking of a RxRPC AF block for the second part of the chain which seems rarer.

Systemd seems to have this setting for units since 2011:

> The setting RestrictAddressFamilies aims to restrict what socket address families can be used. When using it, the default is that it is used as an allow-list and define what address families can be used.

> Example

> A common combination might look like this.

   [Service]
   SystemCallArchitectures=native
   RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX

Re: Dirty Frag: Universal Linux LPE

#352

Post by qrobit »

Asraelite wrote: post #267
anygivnthursday wrote: post #221

Earlier quoted context omitted.

Secure boot and disk enryption are not that unusual nowdays

Secure boot doesn't provide security, just control for device manufacturers. Physical access always means the device is pwned. You can install a keylogger or something similar.

Secure boot ensures the image you boot was not tampered with. You can't install keylogger without tampering with the image. If you wanted to install physical keylogger, you would need to open the device up, and at least my laptop provides detection of bottom cover removal, meaning the system will ask you for a bios password if the laptop was opened up.

Re: Dirty Frag: Universal Linux LPE

#353

Post by Yokohiii »

furyofantares wrote: post #342
Yokohiii wrote: post #199

Earlier quoted context omitted.

The finding started with human intuition and was assisted by an LLM. You can yell "AI sec firm" 1000 times. A human got it started. You shouldn't die on that hill.

Of the MANY things I've completed in the last year that I would never have done without an LLM, a human got 100% of them started. The ideas were mine in every case. But it is still a fact that I have been taking on all sorts of tasks I would never have taken on if I didn't have power tools.

My comment was solely about the correct attribution who made the initial finding. It's not a comment about the value of AI. I think we can get facts right and still argue for or against AI.

Re: Dirty Frag: Universal Linux LPE

#354

Post by furyofantares »

Yokohiii wrote: post #353
furyofantares wrote: post #342

Earlier quoted context omitted.

Of the MANY things I've completed in the last year that I would never have done without an LLM, a human got 100% of them started. The ideas were mine in every case. But it is still a fact that I have been taking on all sorts of tasks I would never have taken on if I didn't have power tools.

My comment was solely about the correct attribution who made the initial finding. It's not a comment about the value of AI. I think we can get facts right and still argue for or against AI.

That's a pet peeve of mine as well, the inability to discuss facts / correct mistaken things on the internet, if the fact/mistake is on the "wrong" side of an argument.

I don't think I'm doing that though.

The context is a discussion about whether it would have been found without the assistance of an LLM. I agree that further upthread there maybe some misattribution but it is not present in the post you were directly replying to and it is not really the argument being made.

Re: Dirty Frag: Universal Linux LPE

#355

Post by ahartmetz »

unethical_ban wrote: post #347
ahartmetz wrote: post #305

Earlier quoted context omitted.

Jeez, care to reply instead of downvoting? I would really like to know. I do keep an eye on the BSDs as a good example in some areas where Linux is bad.

Didn't downvote. But if you don't know the difference, then you seemed pretty confident in describing their differences. BSDs are an actual fork of UNIX from the 90s. Linux is a kernel whose code is not forked from UNIX. The userland is most often GNU, which stands for GNU's Not Unix.

That's not an architectural difference though. The way that the systems are technically structured seems very, very similar to me. There are quality differences (BSD generally better) and feature and performance differences (Linux generally better), but not basic approach differences - is that wrong?

Re: Dirty Frag: Universal Linux LPE

#357

Post by Atlas26 »

lunar_rover wrote: post #160
chromacity wrote: post #85

If this indeed works on all major distributions, I just continue to be amazed by how irresponsible the maintainers are. We're talking about optional kernel functionality that's presumably useful to something like This feels like the practice of Linux distros back in 1999 when they'd ship default installs with dozens of network services exposed to the internet. Except it's not 1999 anymore.

In many ways non mobile computers are very much still stuck in 1999. Android is significantly more secure than other Linux systems because it's much younger and had the chance to integrate mandatory access control into the entire stack.

The only thing Android shares with Linux desktop/server Linux is the kernel, the entire rest of the OS built on top of it is completely different so it’s a pointless comparison. While it uses the Linux kernel, it’s not considered the Linux everyone is commonly talking about here ie gnu/Linux (insert copypasta here).

Mobile OS are also essentially required to be much more controlled and locked down due to FCC regulations and the strictness surrounding modems and other RF emitting devices.

Re: Dirty Frag: Universal Linux LPE

#358

Post by Yokohiii »

furyofantares wrote: post #354
Yokohiii wrote: post #353

Earlier quoted context omitted.

My comment was solely about the correct attribution who made the initial finding. It's not a comment about the value of AI. I think we can get facts right and still argue for or against AI.

That's a pet peeve of mine as well, the inability to discuss facts / correct mistaken things on the internet, if the fact/mistake is on the "wrong" side of an argument. I don't think I'm doing that though. The context is a discussion about whether it would have been found without the assistance of an LLM. I agree that further upthread there maybe some misattribution but it is not present in the post you were directly…

His whole sentiment was yelling several times "LLMs did this". He wanted to smuggle his pro AI attribution in, one way or another. In that way I could also argue "without humans, we wouldn't have LLMs." But it doesn't have value, right? I don't know why some try so hard to play down any human impact in this context. LLMs can help to find bugs. Without broader context it's a good and interesting thing. There is no need to trample over everything left and right just to overhype it.

Re: Dirty Frag: Universal Linux LPE

#359

Post by rafram »

ahartmetz wrote: post #68
unethical_ban wrote: post #12

Here's a general question, are these vulnerabilities hitting Linux more than BSDs due to hit being a larger target or because its architecture is less secure by design?

AFAIU, Linux and the BSDs have basically the same architecture - the BSDs just value secure and simple, understandable code more highly than Linux vs features and performance.

https://news.ycombinator.com/item?id=48077971

Re: Dirty Frag: Universal Linux LPE

#360

Post by ActorNightly »

netheril96 wrote: post #169
ActorNightly wrote: post #135

Earlier quoted context omitted.

Because in order to exploit this, you have to have direct access to the computer. Either through malicious usb device, or by exploiting some supply chain or a known piece of software that will be willingly or automatically installed, and furthermore you need to be able to essentially run arbitrary terminal commands, which is a huge breach of isolation in that software. If an attacker manages to do all that, its alrea…

You are assuming that LPE only applies to the user that holds all the sensitive stuff. But it also applies to users created specifically for isolation. Without LPE they would not have access to anything important even if they were compromised.

It doesn't matter which "user" this goes through. If an attacker can get hold of a users control to the point where they can execute arbitrary scripts, you have already lost.
Post reply on HN