Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

nebusec.ai

Post reply on HN
Print view View original

111–120 of 209 posts

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#111

Post by ChocolateGod »

goodburb wrote: post #87
0x1ceb00da wrote: post #79

Does that mean any android app can use ndk native code execution to become root? Does selinux help here?

Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely. Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way. Any compromised app on the Play store or external can get root access instantly,…

> Considering that it's rare to get kernel (or any) updates on non-flagship phones

How the cluster f*k of the Android update situation Google has allowed this to happen really needs a regulator to step in.

Planned obsolescence is supposed to be illegal in Europe.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#112

Post by ChocolateGod »

kuschku wrote: post #105
goodburb wrote: post #96

Earlier quoted context omitted.

Agreed, but I think this will force the average user to upgrade* their phones after losing access to sensitive apps (bank, gov) before getting compromised. Good news for reusing old phones and taking control. *as in replace

We should be fighting against SafetyNet and similar attestation systems. The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card, you don't need a locked down operating system. Which then allows devices to live for much longer. We're slowly losing the war on General Purpose Computing. https://media.ccc.de/v/28c3-4848-en-the_coming_war_on_genera...

> We should be fighting against SafetyNet and similar attestation systems. The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card

So you want a bank card/ID card to be required each time you use Google Pay? What's the point of Google Pay then.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#113

Post by didntcheck »

kuschku wrote: post #95
goodburb wrote: post #87

Earlier quoted context omitted.

Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely. Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way. Any compromised app on the Play store or external can get root access instantly,…

> I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity". It's silly that whenever I…

> You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet?

Are you sure that's true? The whole reason why modern Safetynet/Play Integrity uses HSM data where possible is that you can't spoof that with root (without a microcode bug). It does not trust the running OS by design

I just tried GrapheneOS's https://attestation.app/ on a stock Pixel, and all of the OS version info shows in the "hardware verified" section

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#114

Post by girvo »

dang wrote: post #78
otterley wrote: post #73

Earlier quoted context omitted.

Non native speakers have been on HN since its inception. Unless you mean something else?

Sorry, I was posting hastily and can see how that was unclear. Unfortunately I've forgotten my point. Perhaps it was this: there are many non-native English speakers who have valuable things to contribute to HN, who don't yet have sufficient English or don't feel they do, and therefore resort to LLMs to do their English for them. Should they automatically be excluded?

They should be included! But there's a difference between machine translation and technical-writing-using-an-LLM, in my opinion. One has a lot more humanness to it, still.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#115

Post by maple3142 »

dijit wrote: post #76
insanitybit wrote: post #52

Earlier quoted context omitted.

They are a security boundary. The fact that you need a vulnerability to escape them is proof of that. They just don't have a particularly high cost of escape because reachable kernel vulnerabilities are so common.

Escape from docker containers is trivially easy, if you are able to run as the root user in the container itself. Many (maybe most) containers actually default to running programs as root. Kernel exploit not required.

If you are given a shell with `docker run -it --rm alpine:3 sh`, can you read the /etc/shadow on the host without kernel exploit? Assuming the docker and kernel are sufficiently update-to-date (e.g. latest Docker on Debian Stable).

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#117

Post by netheril96 »

ActorNightly wrote: post #80
mrbluecoat wrote: post #5

Earlier quoted context omitted.

Seems low considering the wide impact, but maybe the only thing corporations throw big money at is remote exploits?

How is it a wide impact? It requires being able to execute arbitrary code on the machine in userspace. If you have that, most of the time you don't even care about kernel level exploits.

Supposedly it can root Android.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#118

Post by ChocolateGod »

charcircuit wrote: post #107
karteum wrote: post #100

Earlier quoted context omitted.

"this will force the average user to upgrade their phones" A lot of phones don't receive any upgrades after 1 or 2 years... I wish that Google would have forced vendors to implement a proper hardware abstraction (uefi or similar) so that a single kernel could run on any smartphone, just like it's the case for PCs...

Google has required vendors to do that since Android 12. For a given version that same exact kernel is used on all phones with that version. https://source.android.com/docs/core/architecture/kernel/gen...

Unfortunately it still requires OEMs to ship that kernel.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#119

Post by starfallg »

ChocolateGod wrote: post #111
goodburb wrote: post #87

Earlier quoted context omitted.

Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely. Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way. Any compromised app on the Play store or external can get root access instantly,…

> Considering that it's rare to get kernel (or any) updates on non-flagship phones How the cluster f*k of the Android update situation Google has allowed this to happen really needs a regulator to step in. Planned obsolescence is supposed to be illegal in Europe.

More to do with how the ARM ecosystem works and the resulting lack of openness and standardisation in the hardware interface.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#120

Post by ChocolateGod »

starfallg wrote: post #119
ChocolateGod wrote: post #111

Earlier quoted context omitted.

> Considering that it's rare to get kernel (or any) updates on non-flagship phones How the cluster f*k of the Android update situation Google has allowed this to happen really needs a regulator to step in. Planned obsolescence is supposed to be illegal in Europe.

More to do with how the ARM ecosystem works and the resulting lack of openness and standardisation in the hardware interface.

There's a fair amount of blame there, but it's also partially how Android has to be compiled/built for the hardware.
Post reply on HN