Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

nebusec.ai

Post reply on HN
Print view View original

131–140 of 209 posts

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#131

Post by chlorion »

maple3142 wrote: post #115
dijit wrote: post #76

Earlier quoted context omitted.

Escape from docker containers is trivially easy, if you are able to run as the root user in the container itself. Many (maybe most) containers actually default to running programs as root. Kernel exploit not required.

If you are given a shell with `docker run -it --rm alpine:3 sh`, can you read the /etc/shadow on the host without kernel exploit? Assuming the docker and kernel are sufficiently update-to-date (e.g. latest Docker on Debian Stable).

No.

The "root" you get in docker is not actually root outside of the namespace the container in running in.

Assuming no bugs in the kernel, it should not be able to do anything more than the UID that it's mapped from.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#133

Post by no_time »

Chu4eeno wrote: post #12
goodburb wrote: post #10

Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older). Two boot looped, I had to enter recovery and the other just powered off [0]. The demo modifies the wallpaper on supported Pixel devices. [0] IonStack https://rootme.nebusec.ai ____ Tip: Install a Chromium flavor browser (Chromite) separate from the main browser. Disable Javascript and hardware acce…

fwiw, the firefox vulnerability seems to be CVE-2026-10702 (type confusion in the ionmonkey jit compiler): https://www.sentinelone.com/vulnerability-database/cve-2026-...

Severity score of 4.3 seems low considering the click2pwn in this thread. Though Firefox on Android is uniquely bad because of the lack of sandboxing.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#134

Post by ChocolateGod »

kuschku wrote: post #122
ChocolateGod wrote: post #112

Earlier quoted context omitted.

> We should be fighting against SafetyNet and similar attestation systems. The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card So you want a bank card/ID card to be required each time you use Google Pay? What's the point of Google Pay then.

Once upon a time(tm), Google had a great solution for that: You could get a credit card in nano SIM format, and insert into in your dual-SIM phone. That then allows you to do secure NFC credit card payments even on a rooted phone with custom ROM.

That doesn't work when someone has multiple or virtual cards. That also means if someone steals my phone they get my credit card too.

Not a great solution.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#135

Post by ChocolateGod »

inigyou wrote: post #127
ChocolateGod wrote: post #111

Earlier quoted context omitted.

> Considering that it's rare to get kernel (or any) updates on non-flagship phones How the cluster f*k of the Android update situation Google has allowed this to happen really needs a regulator to step in. Planned obsolescence is supposed to be illegal in Europe.

Why would Google be responsible for Samsung and Huawei?

Because it's their operating system and their live services?

Just like Microsoft with Windows.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#136

Post by marginalia_nu »

alexjplant wrote: post #26

> This is the same shape as many other life-cycle bugs [...] Claude-ism detected. IME with Claude Code an object does not have a type or definition, apparently, but rather a shape (or at least it reaches for that word before more technically-accurate ones). Problems are not of a similar class or type, but of the same shape. Functions are not defined by their signatures but by their shape. Who talks like this and how…

No this is normal programming terminology. Here I am using 'shape' in this sense back in 2021:

https://www.marginalia.nu/log/40-wasted-resources/

and even more similar usage again in 2023 'the shape of the algorithm' (which was post-claude I guess, but this was before I even tested any LLM):

https://www.marginalia.nu/log/87_absurd_success/

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#137

Post by bana-io »

goodburb wrote: post #10

Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older). Two boot looped, I had to enter recovery and the other just powered off [0]. The demo modifies the wallpaper on supported Pixel devices. [0] IonStack https://rootme.nebusec.ai ____ Tip: Install a Chromium flavor browser (Chromite) separate from the main browser. Disable Javascript and hardware acce…

What Android devices did you test on exactly?

I take it you did NOT unlock the bootloader?

> Two boot looped, I had to enter recovery and the other just powered off [0].

Absolutely crazy that it is possible to brick someone's phone via an exploit but ... hey.

After the power off what happened? Do things seem normal?

When it entered recovery mode where you able to get the phone in a clean state again? I take it that you did?

I'd really like to run this but I, ideally, do not want to run something random from the internet. It's a shame there is no `Dockerfile` to build this exploit/POC. All I want is LPE to `root` on a Samsung (Snapdragon) phone.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#138

Post by bana-io »

etenal wrote: post #24
goodburb wrote: post #10

Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older). Two boot looped, I had to enter recovery and the other just powered off [0]. The demo modifies the wallpaper on supported Pixel devices. [0] IonStack https://rootme.nebusec.ai ____ Tip: Install a Chromium flavor browser (Chromite) separate from the main browser. Disable Javascript and hardware acce…

Thanks for testing, we currently only tested it on Pixel 10, but there are a few people on our repo creating PR to support other devices, you can take a look here https://github.com/NebuSec/CyberMeowfia

Can you please provide a `Dockerfile` to build the POC/exploit?

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#139

Post by ptx »

chlorion wrote: post #131
maple3142 wrote: post #115

Earlier quoted context omitted.

If you are given a shell with `docker run -it --rm alpine:3 sh`, can you read the /etc/shadow on the host without kernel exploit? Assuming the docker and kernel are sufficiently update-to-date (e.g. latest Docker on Debian Stable).

No. The "root" you get in docker is not actually root outside of the namespace the container in running in. Assuming no bugs in the kernel, it should not be able to do anything more than the UID that it's mapped from.

Does Docker use user namespaces by default? Otherwise root in the container is actually root on the host, from what I read. Correct me if I'm wrong.

(Privileges are still limited by seccomp filters blocking some syscalls, and there's SELinux to block some other stuff, but it's still the actual root user without user namespaces, I think?)

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#140

Post by inigyou »

ChocolateGod wrote: post #135
inigyou wrote: post #127

Earlier quoted context omitted.

Why would Google be responsible for Samsung and Huawei?

Because it's their operating system and their live services? Just like Microsoft with Windows.

Great analogy! Why would Microsoft be responsible for Lenovo?
Post reply on HN