Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD has a use-after-free allowing local privilege escalation to root

nvd.nist.gov

Post reply on HN
Print view View original

91–100 of 170 posts

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#91

Post by bigbuppo »

bee_rider wrote: post #49
mmooss wrote: post #27

Earlier quoted context omitted.

I think of it more as their attention to quality in their code: Given the 'quality' of most code, especially under commercial pressure, it's no surprise that much more effective tools will find many more vulnerabilities. Did OpenBSDs quality approach work in this respect?

A local escalation in BSD is still apparently worth a front page post here, so that seems pretty good. I wonder why we don’t see more about local escalations in Windows. Of course, being closed source is a little bit of a barrier, but these tools can read assembly pretty well, right?

You don't hear about them because you're probably not paying attention to where all the Windows admins hang out. Nearly every single patch tuesday over the past couple of years has been an emergency race to get things patched as soon as you can, for both local and remote exploits.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#92

Post by nubinetwork »

TacticalCoder wrote: post #63
Tiberium wrote: post #4

Seems to be found as a part of Patch The Planet [0] which is basically OpenAI giving model access and Trail of Bits using them to find vulnerabilities in OSS projects. [0] https://openai.com/index/patch-the-planet/

Sidenote but... I read this on that link: dnsmasq: Codex Security independently identified vulnerable patterns corresponding to four of the six dnsmasq CVEs later fixed in 2.92rel2: CVE-2026-4890 (opens in a new window), CVE-2026-4891 (opens in a new window), CVE-2026-4892 (opens in a new window), and CVE-2026-517 dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that…

I would love to, but apparently its needed for libvirt.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#93

Post by yjftsjthsd-h »

acdha wrote: post #56
kevincox wrote: post #47

Earlier quoted context omitted.

It is quite possible that Linux is the bigger target so it gets more focus. Vulnerabilities there are generally considered more valuable and notable. It would be very difficult to use these numbers to get a meaningful "more secure" stance as there are tons of variables.

Linux also has a ton of extra functionality so I think you’d also have to do some adjustment for “as a user would I be at risk?” versus “can I be a user because it supports my needs?” Some of that would be unfavorable for many users (e.g. a Linux user who is exposed due to a network protocol or file system they’ll never use) but that’s certainly not true of every feature.

That cuts both ways, though. If the functionality is present by default but I'm not using it, that's just extra vulnerability surface. (Of course, if I do want that feature, then its absence is kinda a problem)

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#94

Post by ImJamal »

ori_b wrote: post #26
dcrazy wrote: post #23

Earlier quoted context omitted.

Or Linux development is significantly more active.

This is an external audit. Why would Linux activity make a difference here? Are you theorizing that the churn causes bugs?

If you add 5 new pieces of hardware support in Linux vs 1 new in OpenBSD, I would expect more issues in Linux.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#95

Post by mmooss »

tredre3 wrote: post #85
seethishat wrote: post #35

Earlier quoted context omitted.

They appreciate technical correctness and they do not exaggerate. Most 'security researchers' are not technically correct and they exaggerate a lot (seeking fame and all). Dismissing their claims is not being selective, it's just the right thing to do.

The fact that most security researches tend to bullshit to pump up their numbers doesn't mean that OpenBSD isn't selective. The main claim from OpenBSD is "Only two remote holes in the default install since forever". It is technically true. But it's also selective because they deliberately disable every service by default and don't install any software beyond core. Once the OS is configured to be useful, we're far fr…

> they deliberately disable every service by default and don't install any software beyond core.

Do you prefer that or everything (or most/many services) being enabled by default? It's a good practice and, for me, very practical - I don't need to find everything I'm not using and disable it.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#96

Post by toast0 »

CursedSilicon wrote: post #84
1vuio0pswjnm7 wrote: post #76

Earlier quoted context omitted.

"dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines." Would be nice if OpenWRT would stop including it by default

What else is out there that fits openWRT's use case? BIND seems like it would be a bit "heavy"

For caching recursive dns, unbound?

I got the feeling that dnsmasq does more than just recursive dns though?

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#97

Post by gunapologist99 »

knorker wrote: post #89
somat wrote: post #86

Earlier quoted context omitted.

That does not match my experience with obsd. It is not so much minimalism as they are not afraid to reinvent the wheel. A obsd install is full of services, more than most linux installs I have seen. For example you can imagine my disappointment when I discovered what a pain in the ass it is to get a pflow producer working on linux after doing the first one on openbsd.

I'd say it's true. They chose to not implement SMP until consumer CPUs surprised them by going multi thread. And obsd has no Bluetooth, right? A pretty big subsystem to drop because security.

But Bluetooth is basically a giant blast of security vulnerabilities. On the consumer side, yes, it's a big subsystem to drop, but on the server side, it's a little bit different!

I'm not an OpenBSD expert, but seems like you should be able to pass BT through USB and then do that in a subsystem or an isolated environment like a VM.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#98

Post by stackghost »

mmooss wrote: post #95
tredre3 wrote: post #85

Earlier quoted context omitted.

The fact that most security researches tend to bullshit to pump up their numbers doesn't mean that OpenBSD isn't selective. The main claim from OpenBSD is "Only two remote holes in the default install since forever". It is technically true. But it's also selective because they deliberately disable every service by default and don't install any software beyond core. Once the OS is configured to be useful, we're far fr…

> they deliberately disable every service by default and don't install any software beyond core. Do you prefer that or everything (or most/many services) being enabled by default? It's a good practice and, for me, very practical - I don't need to find everything I'm not using and disable it.

Nobody is saying that their minimal default install is itself problematic.

But trumpeting your default install's safety record doesn't actually say much when the default install doesn't actually do anything. As soon as you add a package or a port you're beyond "default install" territory and their vaunted security reputation's coverage.

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#99

Post by throw-qqqqq »

dcrazy wrote: post #36
throw-qqqqq wrote: post #33

Earlier quoted context omitted.

The Linux kernel is generally much larger than OpenBSD which is quite minimal. But I do agree with you - not directly related to activity.

As another commenter said, number of bugs increases with lines of code changed.

I completely agree with that

Re: OpenBSD has a use-after-free allowing local privilege escalation to root

#100

Post by ssl-3 »

gnoack wrote: post #81
tosti wrote: post #31

Earlier quoted context omitted.

When more code is written, more bugs are written. Or, if the act of debugging is removing the bugs from software, then the act of programming is to put the bugs in the software.

Yes, "en-bugging" :)

I think "embuggening" has better cromulence.

Use it as a verb, like embiggening. :)

Post reply on HN