21–30 of 41 posts
Earlier quoted context omitted.
That's pretty interesting. Does it mean it allows escaping Docker containers if you compromise a service ran as root in it?
No, Docker usually drops CAP_NET_RAW within the container. But you can change that and other container technologies definitely keep CAP_NET_RAW within the container.
I wish I was smart enough for the article. 8 years of web dev doesn't make the cut unfortunately.
yeah webapps in general are the most simple aspect of programming that you can get paid to do. Not knocking it though
Someone correct me if I'm wrong: This is a locally exploitable privilege escalation involving creation of the socket, triggerable from user level, so exploitable by local users or as a followup after another exploit is used to get some level of local access, correct?
Not really. Requires to have the CAP_NET_RAW capability, which is pretty rare. (This capability allows you raw access to the network interface, which is usually only given to the root user)
Earlier quoted context omitted.
yeah webapps in general are the most simple aspect of programming that you can get paid to do. Not knocking it though
I personally find embedded programming easier than web development...
Earlier quoted context omitted.
I personally find embedded programming easier than web development...
But isn't embedded programming more complex? as in, it requires a well founded understanding of CS concepts, as well as requires advanced ability in programming and math.
Your task is to make a button that's currently green and make it blue instead. What's the right file(s) to edit? How many layers of caching do you need to disable to see that your change actually worked? Do you need to restart anything after the change for it to be seen?
The current green color could be:
- in a css file, but one that has to go through SAAS/LESS first, or maybe not. Or maybe there's more than one entry, depending on @media screen resolution? Or maybe it's not a file at all...the css "file" is generated on the fly by some server-side framework.
- in an html file, but in tags. Or maybe dynamically generated style tags via client side javascript. Or maybe server-side dynamically generated style tags? Or maybe not style tags at all? Perhaps a style attribute on the button.
- Or hey, that looks like a button, but it's not a button at all. It's an tag with button styling. And it's green, but only because of a background image. Which is loaded how (static css? dynamic js style manipulation? inline tag in the ? something else?)
[1] http://web.mit.edu/adorai/www/seuss-technical-writing.html
Earlier quoted context omitted.
That's pretty interesting. Does it mean it allows escaping Docker containers if you compromise a service ran as root in it?
No, Docker usually drops CAP_NET_RAW within the container. But you can change that and other container technologies definitely keep CAP_NET_RAW within the container.
Otherwise no one could ping from a container.
Earlier quoted context omitted.
yeah webapps in general are the most simple aspect of programming that you can get paid to do. Not knocking it though
(and I can't do any frontend work). Every job has its own difficulties and its own obstacles. off-topic, btw, I read tpacket == tptacek. He can easily hide in Linux kernel. No one noticed, until now.
I believe that the serial device /dev/ttyS0 was named in honor of Theodore Ts'o. So maybe tpacket could be at least retroactively declared to honor tptacek.
Bottom line - locally exploitable vulnerability in the linux kernel, in case you have the CAP_NET_RAW capability which never really happens. Not a real security threat for your standard linux distro. On the other hand, this is a great technical write-up that describes thoroughly the internals of some of the linux kernel subsystems. Probably the best documentation you can find for some subsystems. Also shows how they…
No. Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.
Someone correct me if I'm wrong: This is a locally exploitable privilege escalation involving creation of the socket, triggerable from user level, so exploitable by local users or as a followup after another exploit is used to get some level of local access, correct?
Not really. Requires to have the CAP_NET_RAW capability, which is pretty rare. (This capability allows you raw access to the network interface, which is usually only given to the root user)