Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

nebusec.ai

Post reply on HN
Print view View original

91–100 of 209 posts

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#91

Post by poly2it »

dang wrote: post #86
poly2it wrote: post #83

Is HN bugged? I swear I have read these comments the day prior, there is no way they are from within 10 hours?

I don't know what "bugged" means but what you're seeing is probably an artifact of HN's re-upping system. We re-upped this thread and that relativized the timestamps on the previously existing comments ( https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... ). Sorry for the confusion—I know it's weird but so far no one has come up with an alternative that is less confusing. The reason I re-upped this post,…

Ah, I didn't know actual post timestamps for comments are updated. That explains it, thank you!

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#92

Post by jeroenhd »

0x1ceb00da wrote: post #79

Does that mean any android app can use ndk native code execution to become root? Does selinux help here?

selinux doesn't help when the kernel itself has been compromized like this. Sandboxes from Android and containerisation tools like Docker do not protect you against this exploit. The only feasible method of restriction is full virtualisation (assuming that if you use KVM, last week's CVE-2026-53359 patches are rolled out everywhere).

Any app that can run native code execution on any version of Linux in the past fifteen years can get root until kernel updates arrive on your devices.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#93

Post by etenal »

ActorNightly wrote: post #80
mrbluecoat wrote: post #5

Earlier quoted context omitted.

Seems low considering the wide impact, but maybe the only thing corporations throw big money at is remote exploits?

How is it a wide impact? It requires being able to execute arbitrary code on the machine in userspace. If you have that, most of the time you don't even care about kernel level exploits.

It's a browser to kernel full chain exploit, from url click to root your device.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#94

Post by athrowaway3z »

ActorNightly wrote: post #80
mrbluecoat wrote: post #5

Earlier quoted context omitted.

Seems low considering the wide impact, but maybe the only thing corporations throw big money at is remote exploits?

How is it a wide impact? It requires being able to execute arbitrary code on the machine in userspace. If you have that, most of the time you don't even care about kernel level exploits.

https://rootme.nebusec.io/

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#95

Post by kuschku »

goodburb wrote: post #87
0x1ceb00da wrote: post #79

Does that mean any android app can use ndk native code execution to become root? Does selinux help here?

Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely. Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way. Any compromised app on the Play store or external can get root access instantly,…

> I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future.

You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity".

It's silly that whenever I see a vulnerability like this, all I can think about is "finally, a way to get control over my own devices back". Once again, Stallman was right.

https://www.gnu.org/philosophy/right-to-read.en.html

Personally, I'll use this to root my Android TV and Chromecast devices and remove the shitty ads in the launcher (which Google added after I bought the devices!).

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#96

Post by goodburb »

kuschku wrote: post #95
goodburb wrote: post #87

Earlier quoted context omitted.

Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely. Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way. Any compromised app on the Play store or external can get root access instantly,…

> I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity". It's silly that whenever I…

Agreed, but I think this will force the average user to upgrade* their phones after losing access to sensitive apps (bank, gov) before getting compromised.

Good news for reusing old phones and taking control.

*as in replace

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#97

Post by _def »

0xbadcafebee wrote: post #75

Do we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend? Also can we talk about how bad Linux security is? At this point it's becoming a real liability to run anything on Linux that needs to be secure. OpenBSD has been around for ages, is written in C, and is really, really secure. Do they support containers yet (or microVMs)? Cuz if they do, I'm moving my wo…

> and is really, really secure

... until its getting popular usage and gets targeted for vulnerability research

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#98

Post by phire »

password4321 wrote: post #6

Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.

Not really. Generally we use "Local Privilege Exploit" to describe an exploit that goes from a reasonably normal user privileges to root privileges.

And we don't usually worry about them, because an application with normal user privileges can already to so much damage.

But this exploit can be triggered from inside a tightly sandboxed process, such as firefox's isolated browser process. Which means the attacker now only needs to chain two exploits together: One javascript exploit to get local code execution in an isolated sandbox, and this one to jump all the rest of the way to kernel mode.

Which means, you should update both firefox, and your linux kernel.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#99

Post by sethammons »

alexjplant wrote: post #26

> This is the same shape as many other life-cycle bugs [...] Claude-ism detected. IME with Claude Code an object does not have a type or definition, apparently, but rather a shape (or at least it reaches for that word before more technically-accurate ones). Problems are not of a similar class or type, but of the same shape. Functions are not defined by their signatures but by their shape. Who talks like this and how…

When working in Elixir, everything is about the shape of things. I have now taken that word usage from that ecosystem because I find it useful.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#100

Post by karteum »

goodburb wrote: post #96
kuschku wrote: post #95

Earlier quoted context omitted.

> I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity". It's silly that whenever I…

Agreed, but I think this will force the average user to upgrade* their phones after losing access to sensitive apps (bank, gov) before getting compromised. Good news for reusing old phones and taking control. *as in replace

"this will force the average user to upgrade their phones"

A lot of phones don't receive any upgrades after 1 or 2 years...

I wish that Google would have forced vendors to implement a proper hardware abstraction (uefi or similar) so that a single kernel could run on any smartphone, just like it's the case for PCs...

Post reply on HN