Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

nebusec.ai

Post reply on HN
Print view View original

191–200 of 209 posts

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#191

Post by zamalek »

dboreham wrote: post #170
chlorion wrote: post #131

Earlier quoted context omitted.

No. The "root" you get in docker is not actually root outside of the namespace the container in running in. Assuming no bugs in the kernel, it should not be able to do anything more than the UID that it's mapped from.

Hmm. Either I've lost my mind, or you're running a different Docker than me, or you're thinking of some strange scenario such as a Mac where docker is actually inside a VM, or you're wrong. While there is a feature to do with UID mapping, it doesn't actually work/isn't usable/nobody uses it in current docker iirc. Therefore root in the container very much is root on the host.

UID mapping is how rootless docker works, so tons of people are using it

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#194

Post by anthk »

titularcomment wrote: post #102
0xbadcafebee wrote: post #75

Do we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend? Also can we talk about how bad Linux security is? At this point it's becoming a real liability to run anything on Linux that needs to be secure. OpenBSD has been around for ages, is written in C, and is really, really secure. Do they support containers yet (or microVMs)? Cuz if they do, I'm moving my wo…

OpenBSD is the Linux of a decade or two ago, not attracting attention and not being compatible or useful for quite a lot of stuff.

Just OpenSSH, nothing ;)

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#195

Post by anthk »

uecker wrote: post #173
inigyou wrote: post #157

Earlier quoted context omitted.

Not true, it can also occur in C++, Zig, and assembly language.

Or Rust, when not sticking exclusively to safe Rust, but this is not really possible in many systems programming scenarious.

Golang, C# and even Java does have its exploits.

Maybe just Algol68 and Rust can withstand this, among ADA. And PL/1 under Multics.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#196

Post by afdbcreid »

anthk wrote: post #193
bitwize wrote: post #88

"Nothing could have prevented this from happening," say users of only language where this happens

Firefox it's written in Rust.

No it's not. Yes it contains a lot of Rust, but it's still mostly C++.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#197

Post by titularcomment »

NexRebular wrote: post #177
titularcomment wrote: post #161

Earlier quoted context omitted.

Personal laptop use with Ada Lovelace or Ampere family NVIDIA GPUs (did you mean this or CUDA, i couldnt tell), personal desktop use with unusual peripherals, dependency on ports, existence and competition of FreeBSD etc. I love OpenBSD's code philosophy (they were the first to introduce a lot of security techniques[1]) and the programs they produce, OpenSSH is a lifesaver, and I use doas for its low footprint on my…

So pretty much only GPU compute (CUDA) and exotic peripherals? I don't see any ports dependency issues as there's been binary packages available forever. Even the install process is a lot faster than any linux I have to use at $work, not to mention easier to automate with autoinstall[0] if needed. [0] https://man.openbsd.org/autoinstall.8

GPU driver support is not limited to CUDA. Devices that require binary blobs of firmware to work properly are not always exotic. Some examples off the top of my head that won't work with OpenBSD hassle-free is Vantage (LLL), Solaar ... but I haven't tested. I understand you finding it easier to work with and it's faster install speeds do pique my interest, yet you being on HN already puts your technical literacy on some low % of gen pop. OpenBSD may be comparable to distros like Gentoo, Void or Arch but certainly not out-of-the-box ones like Ubuntu. They serve different auidences.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#198

Post by cyphar »

NexRebular wrote: post #176
cyphar wrote: post #172

Earlier quoted context omitted.

If there was a similar class of bug in the illumos kernel, it would also allow for a container escape, no? There are many issues with the formulation of containers on Linux (though I think people overstate it whenever bugs like this happen) but ultimately this bug was a UAF that gave you arbitrary code execution in the kernel. Zone IDs are also just numbers in kernel memory... right?

Not necessarily. Zones in illumos (and Solaris before) were designed from ground up to be secure in multitenant workloads[0]. It's quite different from the duct tape style[1] of linux containerization. [0] https://www.usenix.org/legacy/event/lisa04/tech/full_papers/... [1]Tape different things together and see if it holds.

I am aware of the history behind Zones and Jails, but my point is still the same -- the (lack of) protection you get against kernel exploits should be the same because the only thing protecting you from escapes is kernel data structures.

(I've been one of the maintainers of runc -- the most widely use used container runtime on Linux -- for more than a decade, so I'm at least somewhat well-informed on the topic.)

The duct tape criticisms are fair when talking about other vulnerabilities (such as when container runtimes have misconfiguration or other inatomicity bugs) but not really here in the context of a kernel arbitrary code execution gadget. It also seems quite unlikely that the illumos kernel doesn't contain any of these kinds of bugs.

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#199

Post by dang »

raldi wrote: post #54
dang wrote: post #18

Earlier quoted context omitted.

Thanks! I've put that in the toptext now.

I don't actually see that change, unless I misunderstand the meaning of toptext.

Weird - it was there and then went away. It's back now. Thanks!

Re: GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

#200

Post by dang »

abofh wrote: post #58
dang wrote: post #37

Earlier quoted context omitted.

Please don't be snarky or cross into putdowns or personal attack. We're all in (let's call it) the unlucky 10,000 about something. About most things actually. https://news.ycombinator.com/newsguidelines.html

To an extent that's fair, but you do understand that "ive not heard of a vulnerability older than me" begs credulity? Especially with the fifteen years experience comment? I'm all for not being snarky (I'm not), but this was bait

I can understand why it had that effect on you but these are effects it's necessary to resist. From https://news.ycombinator.com/newsguidelines.html, for example: "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."
Post reply on HN