Local privilege escalation via execve() • Hacker News Board

Re: Local privilege escalation via execve()

#21

Post by icedchai » Sat, May 09, 2026, 9:42 PM UTC

jmspring wrote: post #17

cyberpunk wrote: post #11

Earlier quoted context omitted.

Yep. You should treat any system where non-admins regularly login as basically insecure/owned and rig your architecture appropriately. TBH -- I don't have any of these kinds of boxes anymore. Who is really running anything like this in 2026 and for what purpose?

Stability of ecosystem. No systemd. Native ZFS. Jails over Docker. Been using it for 20+ years and it’s my preferred server OS.

Same. I've been using it since 1996. Initially, we used it at an early ISP for DNS, SMTP, and POP3 for roughly 8K users, and it stuck with me.

Re: Local privilege escalation via execve()

#22

Post by dwattttt » Sat, May 09, 2026, 9:46 PM UTC

doublerabbit wrote: post #16

dwattttt wrote: post #10

Earlier quoted context omitted.

If you think Linux is on their first or second, I'm not sure how or what you're counting.

> I'm not sure how or what you're counting. The recent two. FailCopy and DirtyFrag and FreeBSD with Execve. 2 - Linux 1 - FreeBSD. Of course, all OS have had past-time exploits. Three now have made the news.

Your question was "how many high profile privilege escalations Windows has had recently" then? I can't think of any, 0?

Re: Local privilege escalation via execve()

#23

Post by bch » Sat, May 09, 2026, 9:47 PM UTC

cyberpunk wrote: post #11

epcoa wrote: post #4

Earlier quoted context omitted.

Anyone relying on a 30+ year old monolith kernel written in C to not have some exploitable LPEs lurking should stay in basket weaving and out of sysadmin.

Yep. You should treat any system where non-admins regularly login as basically insecure/owned and rig your architecture appropriately. TBH -- I don't have any of these kinds of boxes anymore. Who is really running anything like this in 2026 and for what purpose?

>> monolith kernel written in C

> Who is really running anything like this in 2026 and for what purpose?

Am I parsing your question correctly?

Re: Local privilege escalation via execve()

#24

Post by gdgghhhhh » Sat, May 09, 2026, 9:52 PM UTC

dwattttt wrote: post #22

doublerabbit wrote: post #16

Earlier quoted context omitted.

> I'm not sure how or what you're counting. The recent two. FailCopy and DirtyFrag and FreeBSD with Execve. 2 - Linux 1 - FreeBSD. Of course, all OS have had past-time exploits. Three now have made the news.

Your question was "how many high profile privilege escalations Windows has had recently" then? I can't think of any, 0?

https://nvd.nist.gov/vuln/detail/CVE-2026-21250

Re: Local privilege escalation via execve()

#25

Post by cyberpunk » Sat, May 09, 2026, 9:53 PM UTC

bch wrote: post #23

cyberpunk wrote: post #11

Earlier quoted context omitted.

Yep. You should treat any system where non-admins regularly login as basically insecure/owned and rig your architecture appropriately. TBH -- I don't have any of these kinds of boxes anymore. Who is really running anything like this in 2026 and for what purpose?

>> monolith kernel written in C > Who is really running anything like this in 2026 and for what purpose? Am I parsing your question correctly?

No, I worded it badly. See below.

Re: Local privilege escalation via execve()

#26

Post by stackghost » Sat, May 09, 2026, 9:53 PM UTC

loeg wrote: post #15

cyberpunk wrote: post #6

This is from April 28th, it was patched in 15.0R-p7.

[flagged]

A not-insignificant chunk of the userbase of the various BSDs is there because they were turned off of Linux after controversial things like Gnome 3, systemd being shoved down users' throats despite being a broken mess, wayland (though nobody was as arrogant about wayland as Poettering was about systemd), etc.

All that to say, the BSD userbase as a sizeable subset that are there for countercultural reasons, rather than technical. These are the people who buy into, say, OpenBSD's vaunted security reputation, or believe that "linux bad because reasons", so you're always going to get people in here bragging, because "not using linux" has become part of their identity.

I run a mix of FreeBSD and Linux on my personal devices. The ground truth is that FreeBSD is yet another unix-like OS written in C, and thus not immune from the types of bugs that stem from that lineage. None of the BSD distros are materially more secure or better than a properly-configured and patched Linux.

Re: Local privilege escalation via execve()

#27

Post by murderfs » Sat, May 09, 2026, 9:53 PM UTC

pjmlp wrote: post #7

doublerabbit wrote: post #5

Linux is on their second and FreeBSD is on their first. How many is Windows on?

Plenty, Microsoft has security teams whose job is to attack Windows. Naturally they don't do blog posts about what they find.

Local privilege escalation is largely irrelevant on Windows because basically no one uses it in a multi-user system, and application sandboxing is effectively nonexistent.

Re: Local privilege escalation via execve()

#28

Post by cryptbe » Sat, May 09, 2026, 9:58 PM UTC

Nice to randomly encounter our own work here.

Check out our blog post for a fun walkthrough: https://blog.calif.io/p/cve-2026-7270-how-i-get-root-on-free...

AI-generated working exploit, write-up and prompts: https://github.com/califio/publications/tree/main/MADBugs/fr...

Re: Local privilege escalation via execve()

#29

Post by applfanboysbgon » Sat, May 09, 2026, 9:58 PM UTC

stackghost wrote: post #26

loeg wrote: post #15

Earlier quoted context omitted.

[flagged]

A not-insignificant chunk of the userbase of the various BSDs is there because they were turned off of Linux after controversial things like Gnome 3, systemd being shoved down users' throats despite being a broken mess, wayland (though nobody was as arrogant about wayland as Poettering was about systemd), etc. All that to say, the BSD userbase as a sizeable subset that are there for countercultural reasons, rather th…

The person 'bragging' was not a countercultural user, but rather the FreeBSD engineering lead. They were, however, talking about FreeBSD's response to security vulnerabilities, in contrast to Linux's response.

> thus not immune from the types of bugs that stem from that lineage

They never claimed that FreeBSD didn't have vulnerabilities. I honestly have no idea why grandparent decided to bring up their comment when it exactly validates what the person they were criticising says. GP admits the response to the vulnerability was well-coordinated. The response to security vulnerabilities was the exact, and only, subject of the post they're calling out.

Re: Local privilege escalation via execve()

#30

Post by icedchai » Sat, May 09, 2026, 9:58 PM UTC

stackghost wrote: post #26

loeg wrote: post #15

Earlier quoted context omitted.

[flagged]

A not-insignificant chunk of the userbase of the various BSDs is there because they were turned off of Linux after controversial things like Gnome 3, systemd being shoved down users' throats despite being a broken mess, wayland (though nobody was as arrogant about wayland as Poettering was about systemd), etc. All that to say, the BSD userbase as a sizeable subset that are there for countercultural reasons, rather th…

I also use a mix. I moved to FreeBSD initially after a rough period w/Linux in the late 90's. Today, my FreeBSD machines are all VMs running on Linux hosts!