Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

phoronix.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

#11

Post by dathinab »

bestouff wrote: post #2

Lots of privilege escalations these days. But are there that many multiuser Linux systems nowadays ? I'm under the impression the whole landscape is either servers or single-user desktops (and ofc Android phones).

> many multiuser Linux systems nowadays

not relevant IMHO

we don't live anymore in a time where you can trust that local apps do not misbehave, and in such a context LPE is pretty bad even in a single user system

just thing about all the supply chain problems of recent times

Re: Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

#12

Post by riedel »

bestouff wrote: post #2

Lots of privilege escalations these days. But are there that many multiuser Linux systems nowadays ? I'm under the impression the whole landscape is either servers or single-user desktops (and ofc Android phones).

Many university HPC clusters are run multiuser. At least login nodes.

Re: Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

#14

Post by bestouff »

dathinab wrote: post #11
bestouff wrote: post #2

Lots of privilege escalations these days. But are there that many multiuser Linux systems nowadays ? I'm under the impression the whole landscape is either servers or single-user desktops (and ofc Android phones).

> many multiuser Linux systems nowadays not relevant IMHO we don't live anymore in a time where you can trust that local apps do not misbehave, and in such a context LPE is pretty bad even in a single user system just thing about all the supply chain problems of recent times

I would say that in a single-user system LPE isn't even needed. The moment you run malicious code all bets are off. No need to compromise the system when all your data is under "enemy" control.

Re: Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

#16

Post by fluffybucktsnek »

bestouff wrote: post #14
dathinab wrote: post #11

Earlier quoted context omitted.

> many multiuser Linux systems nowadays not relevant IMHO we don't live anymore in a time where you can trust that local apps do not misbehave, and in such a context LPE is pretty bad even in a single user system just thing about all the supply chain problems of recent times

I would say that in a single-user system LPE isn't even needed. The moment you run malicious code all bets are off. No need to compromise the system when all your data is under "enemy" control.

Technically, running malicious code doesn't necessarily give control over all your data in the device. But common Linux is still lacking in sandboxing practicality, so it might as well be that way.

Re: Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

#17

Post by gnufx »

riedel wrote: post #12
bestouff wrote: post #2

Lots of privilege escalations these days. But are there that many multiuser Linux systems nowadays ? I'm under the impression the whole landscape is either servers or single-user desktops (and ofc Android phones).

Many university HPC clusters are run multiuser. At least login nodes.

Any university or national HPC system as I'd understand the term is multi-user.

There are also things like the extensive high energy physics WLCG compute federation, which is somewhat different, but can potentially be compromised quickly at large scale. For the original copy-fail we didn't want to drain our WLCG Alma9 cluster, or just kill all the jobs like the university HPC system. We got eBPF mitigation in place within a couple of hours, relieved the exploit signature wasn't in logs from the night before. That would have been done earlier if Proofpoint hadn't bounced the forwarded oss-security article as "contains malware"; sigh.

Re: Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

#18

Post by gnufx »

bestouff wrote: post #14
dathinab wrote: post #11

Earlier quoted context omitted.

> many multiuser Linux systems nowadays not relevant IMHO we don't live anymore in a time where you can trust that local apps do not misbehave, and in such a context LPE is pretty bad even in a single user system just thing about all the supply chain problems of recent times

I would say that in a single-user system LPE isn't even needed. The moment you run malicious code all bets are off. No need to compromise the system when all your data is under "enemy" control.

You might not have root on an organizational "managed" system.

Re: Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

#19

Post by jovial_cavalier »

bestouff wrote: post #2

Lots of privilege escalations these days. But are there that many multiuser Linux systems nowadays ? I'm under the impression the whole landscape is either servers or single-user desktops (and ofc Android phones).

Yes, lots of little web services and such run as unprivileged users, not root. I personally run a bunch of stuff as very restricted users in containers, with the threat model being that e.g. an RCE exploit in one of them will only affect the service, not the broader system.

Re: Fragnesia Made Public as Latest Linux Local Privilege Escalation Vulnerability

#20

Post by cpach »

LawnGnome wrote: post #9
chasil wrote: post #7

Earlier quoted context omitted.

RedHat's mitigation is this: $ cat /etc/modprobe.d/dirtyfrag.conf install esp4 /bin/false install esp6 /bin/false install rxrpc /bin/false Are those correct for this exploit? https://access.redhat.com/security/vulnerabilities/RHSB-2026...

I don't know, but the problem with blocking esp4 and esp6 is that IPsec stops working, as I understand it.

For those who can I would recommend upgrading to Wireguard.
Post reply on HN