Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

nebusec.ai

Post reply on HN
Print view View original

81–90 of 209 posts

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#81

Post by coffe2mug »

goodburb wrote: post #10

Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older). Two boot looped, I had to enter recovery and the other just powered off [0]. The demo modifies the wallpaper on supported Pixel devices. [0] IonStack https://rootme.nebusec.ai ____ Tip: Install a Chromium flavor browser (Chromite) separate from the main browser. Disable Javascript and hardware acce…

Would be amazing if this was used to root so-far unrootable android devices. Any suggestions.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#82

Post by ActorNightly »

circularfoyers wrote: post #8
password4321 wrote: post #6

Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.

Since this enables container escape, sounds like this might still impact quite a lot of us?

If you run critical containers under Linux instead of a dedicated hypervisor, you deserve to get hacked.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#85

Post by close04 »

0xbadcafebee wrote: post #75

Do we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend? Also can we talk about how bad Linux security is? At this point it's becoming a real liability to run anything on Linux that needs to be secure. OpenBSD has been around for ages, is written in C, and is really, really secure. Do they support containers yet (or microVMs)? Cuz if they do, I'm moving my wo…

> Do we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend?

Why are you not making easy money hand over fist from these rewards? A couple of weekends of work and you can retire early.

Maybe that's exactly what these infosec companies are. And maybe you need more than "a skid with claude over a weekend" to get anything worthwhile.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#86

Post by dang »

poly2it wrote: post #83

Is HN bugged? I swear I have read these comments the day prior, there is no way they are from within 10 hours?

I don't know what "bugged" means but what you're seeing is probably an artifact of HN's re-upping system. We re-upped this thread and that relativized the timestamps on the previously existing comments (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...). Sorry for the confusion—I know it's weird but so far no one has come up with an alternative that is less confusing.

The reason I re-upped this post, btw, is that it was at the top of a list called "underwater" that we try to look at every day, which lists the most-upvoted posts that for whatever reason didn't happen to make the frontpage. This was at the top of that list.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#87

Post by goodburb »

0x1ceb00da wrote: post #79

Does that mean any android app can use ndk native code execution to become root? Does selinux help here?

Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely.

Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way.

Any compromised app on the Play store or external can get root access instantly, but we can still rely on trust and audits when installing apps which should always be the rule.

I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future.

That's not the case with browsers with random sites and ads which is hardly avoidable, having any sandbox escape is now more severe considering that it bypasses the app container. It's similar to JailbreakMe on iOS [0]

[0] https://en.wikipedia.org/wiki/JailbreakMe

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#90

Post by jurf »

password4321 wrote: post #6

Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.

Got me confused for a sec, as the exploit in the top comment implies JavaScript→root, but it actually relies on two separate exploits.
Post reply on HN