Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

nebusec.ai

Post reply on HN
Print view View original

141–150 of 209 posts

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#141

Post by bana-io »

goodburb wrote: post #10

Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older). Two boot looped, I had to enter recovery and the other just powered off [0]. The demo modifies the wallpaper on supported Pixel devices. [0] IonStack https://rootme.nebusec.ai ____ Tip: Install a Chromium flavor browser (Chromite) separate from the main browser. Disable Javascript and hardware acce…

So I took the risk and ran it on a Samsung S26 Ultra - I will confirm the full details once I have `adb` installed and running.

The exploit/POC (call it what you want) ran or appeared to have executed because:

1. I saw output on the Firefox tab when I navigated to https://rootme.nebusec.io/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d...>.

2. I saw some output from the execution of the POC.

However, after I went to https://rootme.nebusec.io/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d...> the phone froze and refused to respond to any input. The only thing that worked was restarting, which I wonder how it works given the, I think, the kernel has hung. Does anyone know how the kernel is able to respond to events whilst the system has hung? The screen remains on with the partial output of the execution of the POC until the screen saver kicks in ...

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#142

Post by insanitybit »

dijit wrote: post #76
insanitybit wrote: post #52

Earlier quoted context omitted.

They are a security boundary. The fact that you need a vulnerability to escape them is proof of that. They just don't have a particularly high cost of escape because reachable kernel vulnerabilities are so common.

Escape from docker containers is trivially easy, if you are able to run as the root user in the container itself. Many (maybe most) containers actually default to running programs as root. Kernel exploit not required.

I don't think this would change anything even if it were true, which it is not. Running as root in a container opens up tons of footguns but it is not a path out of the container on its own.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#143

Post by boarush »

ChocolateGod wrote: post #111
goodburb wrote: post #87

Earlier quoted context omitted.

Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely. Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way. Any compromised app on the Play store or external can get root access instantly,…

> Considering that it's rare to get kernel (or any) updates on non-flagship phones How the cluster f*k of the Android update situation Google has allowed this to happen really needs a regulator to step in. Planned obsolescence is supposed to be illegal in Europe.

Part of the problem I believe sits on how chip manufacturers (looking at you Qualcomm) handle device trees that should be part of upstream, but are never done due to differences in tooling/proprietary blobs which are also part of the DT. This increases the effort on the OEMs to keep comptability across kernel versions.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#144

Post by ChocolateGod »

inigyou wrote: post #140
ChocolateGod wrote: post #135

Earlier quoted context omitted.

Because it's their operating system and their live services? Just like Microsoft with Windows.

Great analogy! Why would Microsoft be responsible for Lenovo?

Microsoft is responsible for the updates on a Lenovo.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#145

Post by franga2000 »

phire wrote: post #98
password4321 wrote: post #6

Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.

Not really. Generally we use "Local Privilege Exploit" to describe an exploit that goes from a reasonably normal user privileges to root privileges. And we don't usually worry about them, because an application with normal user privileges can already to so much damage. But this exploit can be triggered from inside a tightly sandboxed process, such as firefox's isolated browser process. Which means the attacker now on…

Realistically, if you have a browser sandbox, the system LPE exploit gives you very little more. Everything interesting on a desktop system is accessible by the user account directly.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#146

Post by insanitybit »

ptx wrote: post #139
chlorion wrote: post #131

Earlier quoted context omitted.

No. The "root" you get in docker is not actually root outside of the namespace the container in running in. Assuming no bugs in the kernel, it should not be able to do anything more than the UID that it's mapped from.

Does Docker use user namespaces by default? Otherwise root in the container is actually root on the host, from what I read. Correct me if I'm wrong. (Privileges are still limited by seccomp filters blocking some syscalls, and there's SELinux to block some other stuff, but it's still the actual root user without user namespaces, I think?)

That's right. Docker still runs without user namespaces by default, which means that root is the same user inside and outside of the container. This does open up attack surface and configuration footguns.

Confinement still leverages dropping some root caps, seccomp, various other namespaces, etc.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#147

Post by [deleted] »

insanitybit wrote: post #142
dijit wrote: post #76

Earlier quoted context omitted.

Escape from docker containers is trivially easy, if you are able to run as the root user in the container itself. Many (maybe most) containers actually default to running programs as root. Kernel exploit not required.

I don't think this would change anything even if it were true, which it is not. Running as root in a container opens up tons of footguns but it is not a path out of the container on its own.

[deleted]

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#148

Post by chlorion »

ptx wrote: post #139
chlorion wrote: post #131

Earlier quoted context omitted.

No. The "root" you get in docker is not actually root outside of the namespace the container in running in. Assuming no bugs in the kernel, it should not be able to do anything more than the UID that it's mapped from.

Does Docker use user namespaces by default? Otherwise root in the container is actually root on the host, from what I read. Correct me if I'm wrong. (Privileges are still limited by seccomp filters blocking some syscalls, and there's SELinux to block some other stuff, but it's still the actual root user without user namespaces, I think?)

At least podman does if running rootless, I assume docker supports rootless operation as well.

Not sure about running rootful though. I don't really use rootful containers personally.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#150

Post by amarcheschi »

mschuster91 wrote: post #109
coffe2mug wrote: post #81

Earlier quoted context omitted.

Would be amazing if this was used to root so-far unrootable android devices. Any suggestions.

Wonder if it were possible to use this to (finally) jailbreak DJIs original RC that came with the Mini 3 Pro. It doesn't have a web browser or, virtually, anything of use... but I think it supports enough of a web browser to log in into wifi captive portals.

What can you do with a jailbroken drone rc?
Post reply on HN