Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dirty Frag: Universal Linux LPE

openwall.com

Post reply on HN
Print view View original

21–30 of 370 posts

Re: Dirty Frag: Universal Linux LPE

#21

Post by staticassertion »

Muromec wrote: post #20
staticassertion wrote: post #9

Earlier quoted context omitted.

New vulns are introduced to Linux every day. Fuzzers trigger every single day on Linux. No, nothing will improve here from AI.

There is a finite number of bugs and betters tools that find them mean there is less bugs in the code.

We already find bugs constantly in Linux and they go unaddressed, no one even keeps up with syzkaller reports lol

AI is neat because it's higher signal but yeah no, we're not getting anywhere close to "safe linux", AI or not.

Re: Dirty Frag: Universal Linux LPE

#22

Post by bawolff »

flumpcakes wrote: post #11
baggy_trough wrote: post #2

Disclosure Timeline 2026-04-29: Submitted detailed information about the rxrpc vulnerability and a weaponized exploit that achieves root privileges on Ubuntu to security@kernel.org. 2026-04-29: Submitted the patch for the rxrpc vulnerability to the netdev mailing list. Information about this issue was published publicly. 2026-05-07: Submitted detailed information about the vulnerability and the exploit to the linux-d…

7 days from disclosure to publishing a how-to guide to get root to the entire planet doesn't scream "responsible" disclosure to me.

Its not the reporter's fault that other people broke the embargo.

Re: Dirty Frag: Universal Linux LPE

#23

Post by staticassertion »

miduil wrote: post #5

This again does not work under Android, at least in termux compiled with clang/gcc.

I assume because the rxrpc module is not loaded / provided and because unprivileged user namespaces are not allowed, which should be sufficient to mitigate. Curious if someone else has more details though.

Re: Dirty Frag: Universal Linux LPE

#24

Post by grosswait »

pjmlp wrote: post #14
miduil wrote: post #5

This again does not work under Android, at least in termux compiled with clang/gcc.

Because Android is not Linux, as much as some pretend it is. In fact, given the official public APIs, Google could replace the Linux kernel with a BSD, and userspace wouldn't notice, other than rooted devices, and the OEMs themselves baking their Android distro.

It absolutely is Linux, and yes the JVM could absolutely run on something else. But it is Linux and you can run Linux binaries directly on it - that just isn’t how it is used by end users.

Re: Dirty Frag: Universal Linux LPE

#26

Post by eqvinox »

And I ask again: why the f*ck is algif_aead getting all the flak for copy.fail? It's authencesn being stupid.

authencesn didn't get fixed. Now we got the results of that, turns out you can access the same (I believe) out of bounds write through plain network sockets.

I wish I thought of that, but I didn't.

[ed.: I'm referring to the through-ESP issue. The RxRPC one is AIUI completely unrelated.]

Re: Dirty Frag: Universal Linux LPE

#27

Post by firer »

flumpcakes wrote: post #11
baggy_trough wrote: post #2

Disclosure Timeline 2026-04-29: Submitted detailed information about the rxrpc vulnerability and a weaponized exploit that achieves root privileges on Ubuntu to security@kernel.org. 2026-04-29: Submitted the patch for the rxrpc vulnerability to the netdev mailing list. Information about this issue was published publicly. 2026-05-07: Submitted detailed information about the vulnerability and the exploit to the linux-d…

7 days from disclosure to publishing a how-to guide to get root to the entire planet doesn't scream "responsible" disclosure to me.

My immediate reaction was the same.

But this is very similar to Copy Fail, and I'm assuming there was an assumption that others might also discover this soon as well. Hence the urgency.

At least that's my charitable interpretation.

Re: Dirty Frag: Universal Linux LPE

#28

Post by alex_duf »

staticassertion wrote: post #9
Tiberium wrote: post #4

Do you think with modern LLMs in a few years projects like Linux will have all those low-hanging security bugs fixed? Are we witnessing a transition period, or will nothing change?

New vulns are introduced to Linux every day. Fuzzers trigger every single day on Linux. No, nothing will improve here from AI.

there's an argument to be made that new code will be inspected before being merged and therefore the classes of bugs an LLM is likely to find will not be merged until it's fixed.

Re: Dirty Frag: Universal Linux LPE

#29

Post by eqvinox »

firer wrote: post #18

This is very similar in root cause and exploitation to Copy Fail. Which illustrates pretty well something that's lost when relying heavily on LLMs to do work for you: exploration. I find that doing vulnerability research using AI really hinders my creativity. When your workflow consists of asking questions and getting answers immediately, you don't get to see what's nearby. It's like a genie - you get exactly what yo…

No, unless I'm misreading it it's the *same* root cause: high 32 bits of Extended ESN in IPsec == authencesn module/cipher mode.

The wrong thing got fixed for copy.fail, because people jumped to blame AF_ALG.

[ed.: yes it's the same authencesn issue. https://github.com/V4bel/dirtyfrag/blob/892d9a31d391b7f0fccb... it doesn't say authencesn in the code, only in a comment, but nonetheless, same issue.]

[ed.2: the RxRPC issue is separate, this is about the ESP one]

Post reply on HN