Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FatGid: FreeBSD 14.x kernel local privilege escalation

fatgid.io

Post reply on HN
Print view View original

11–20 of 46 posts

Re: FatGid: FreeBSD 14.x kernel local privilege escalation

#11

Post by yjftsjthsd-h »

djha-skin wrote: post #5

TrueNAS is on FreeBSD, as well as lots of network equipment. This does affect us more than we think as operators.

I would think that pure-storage NAS or network equipment was effectively completely immune to local privilege escalation. I'll give you the NAS where it might be running untrusted containers or such, but that's it.

Re: FatGid: FreeBSD 14.x kernel local privilege escalation

#13

Post by [deleted] »

yjftsjthsd-h wrote: post #11
djha-skin wrote: post #5

TrueNAS is on FreeBSD, as well as lots of network equipment. This does affect us more than we think as operators.

I would think that pure-storage NAS or network equipment was effectively completely immune to local privilege escalation. I'll give you the NAS where it might be running untrusted containers or such, but that's it.

[deleted]

Re: FatGid: FreeBSD 14.x kernel local privilege escalation

#14

Post by sbankowi »

1over137 wrote: post #12
djha-skin wrote: post #5

TrueNAS is on FreeBSD, as well as lots of network equipment. This does affect us more than we think as operators.

Alas, TrueNAS actually switched to Linux a couple of years ago.

FreeBSD was the reason I chose TrueNAS Core. Unfortunately, you are right, TrueNAS Scale (Linux) is where they are focusing all their attention. At this point I will not purchase additional TrueNAS equipment as I feel I was "rug pulled." I get that they are going after more of the Docker container/app market, but I just want a solid ZFS w/excellent networking NAS device. Linux is close to this ideal, but it isn't as "Set and Forget" as FreeBSD (IMO).

Re: FatGid: FreeBSD 14.x kernel local privilege escalation

#18

Post by themafia »

tptacek wrote: post #9
turkeyboi wrote: post #3

Why does this need to be a whole ass website

Why not? This weird complaint has been happening since ~2010 and it has never made any sense. You are strictly better off with the website than without it. When it was vulnerability researchers getting all peevish about the status competition they were running, I at least understood where the complaint was coming from, but even among practitioners, branded vulnerabilities are so much the norm at this point that there…

> You are strictly better off with the website than without it.

Why? This is a better resource in every way: https://cgit.freebsd.org/src/commit/?id=000d5b52c19ff3858a6f...

It details the actual problem instead of showing off tired stack exploit tricks.

Re: FatGid: FreeBSD 14.x kernel local privilege escalation

#19

Post by 866-RON-0-FEZ »

tptacek wrote: post #10
cryo32 wrote: post #7

Earlier quoted context omitted.

You're not going to get anywhere in the security sector unless you gain notoriety i.e. are noticed. This appears to come from dressing up like Elton John in a feather suit and hiring a marketing team.

It's a wall of text about a kernel stack overflow. I'm not sure where the "Elton John" part is. Is it... that they used an accent color?

Maybe the researcher was wearing windshield-wiper spectacles when he discovered the vulnerability.

I don't understand why you're being so defensive about this.

Post reply on HN