Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Linux udisks flaw lets attackers get root on major Linux distros

bleepingcomputer.com

Post reply on HN
Print view View original

271–280 of 287 posts

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#271

Post by shakna »

Dylan16807 wrote: post #261
shakna wrote: post #245

Earlier quoted context omitted.

If you play sound, such as from a browser, or a file you didn't record yourself, then your account is talking to the outside world.

Yes, my account is. It's doing the decoding, not the pipewire account. It's not a cross-account attack that I need to defend from. Maybe I wasn't clear. I'm saying exactly one account has meaningful exposure to the outside world, and it's the only one with valuable files. Not none, but also not multiple. It's effectively single user from a security perspective.

If you have no users for systemd or OpenRC processes somehow, then you're either running a very customised, or non-mainstream build.

In which case your user is in the video group, and a local escape hands over root without any extra effort required.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#272

Post by Dylan16807 »

shakna wrote: post #271
Dylan16807 wrote: post #261

Earlier quoted context omitted.

Yes, my account is. It's doing the decoding, not the pipewire account. It's not a cross-account attack that I need to defend from. Maybe I wasn't clear. I'm saying exactly one account has meaningful exposure to the outside world, and it's the only one with valuable files. Not none, but also not multiple. It's effectively single user from a security perspective.

If you have no users for systemd or OpenRC processes somehow, then you're either running a very customised, or non-mainstream build. In which case your user is in the video group, and a local escape hands over root without any extra effort required.

> If you have no users for systemd or OpenRC processes somehow, then you're either running a very customised, or non-mainstream build.

It's a normal install of linux mint. Resolved and timesyncd are running under systemd users, there's also messagebus, polkitd, kernoops, syslog, avahi, libvirt-dnsmasq, rtkit, colord. And root of course. But pipewire is under my user, and I checked in /etc/passwd that there is no pipewire user or pulseaudio user or any synonym of the word "audio".

> In which case your user is in the video group, and a local escape hands over root without any extra effort required.

But I'm the only real user so if you have to go through my account to get root then root doesn't let you compromise anyone. Which is my point, that an exploit like this is far less meaningful on a system without multiple real accounts.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#273

Post by simoncion »

akdev1l wrote: post #269
simoncion wrote: post #260

Earlier quoted context omitted.

Android is nearly always a single user system in the sense that TheDong was using. Look at the context a little further down in the guy's comment: > Like, I'm the only user on my laptop. If you get arbitrary code execution as my user, you can log my keystrokes, steal my passwords and browser sessions, steal my bitcoin wallet, and persist reasonably well.... and once you've stolen my password via say keylogging me typ…

The context is that on a traditional Linux laptop/desktop you are in fact running everything as one user. Firefox, the desktop environment, your password manager and even `sudo` are traditionally all running as your own user. This is not true in Android whatsoever. Being multi-seat or not has little security implications - most traditional Linux systems can handle multi-seat but they’re still limited in security by r…

> The context is that on a traditional Linux laptop/desktop you are in fact running everything as one user.

Um. Have you ever run 'ps aux', guy? At minimum you're running everything as two users (root and your user account), and probably three to twenty more, depending on what you have installed. I know that on my desktop system

  ps axo user | sort -u | grep -v USER | wc -l
returns 12. Even back in the late 1990s/early 2000s, the default method of operation for Linux systems was to use multiple machine accounts.

> And no nearly all 100% of Linux systems do not run proper multi-user configurations because none of the most popular distributions ship like that. Not in the context of desktop usage anyway.

In addition to my commentary above, see: https://help.ubuntu.com/stable/ubuntu-help/user-add.html.en>

Most Linux systems don't run every single program as a separate Linux user. That doesn't mean that those systems are "in fact running everything as one user".

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#274

Post by rob_c »

Dylan16807 wrote: post #272
shakna wrote: post #271

Earlier quoted context omitted.

If you have no users for systemd or OpenRC processes somehow, then you're either running a very customised, or non-mainstream build. In which case your user is in the video group, and a local escape hands over root without any extra effort required.

> If you have no users for systemd or OpenRC processes somehow, then you're either running a very customised, or non-mainstream build. It's a normal install of linux mint. Resolved and timesyncd are running under systemd users, there's also messagebus, polkitd, kernoops, syslog, avahi, libvirt-dnsmasq, rtkit, colord. And root of course. But pipewire is under my user, and I checked in /etc/passwd that there is no pipe…

I'll save you the bother here, you were probably at risk

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#275

Post by worthless-trash »

burnt-resistor wrote: post #252
worthless-trash wrote: post #240

Earlier quoted context omitted.

I think they mean in regards to cross kernel attacks. vms didn't protect across speculative execution attacks. I believe there are even more course grained timing attacks with dma and memory that are waiting to be abused.

Isolation guarantees: Separate metal > type 1 hypervisors > type 2 hypervisors > containers > processes > OS threads > cooperative threads ;)

Accurate and agree.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#276

Post by Sunspark »

0xbadcafebee wrote: post #223
Sunspark wrote: post #134

Earlier quoted context omitted.

Make BSD great again!

Well, damn... that's not a bad idea. It's only been 20 years since I last tried FreeBSD. Anything changed?

It depends.. the basic principles and structure haven't changed. Drivers have always been a challenge, so they do port Linux drivers over when they can which is a challenge when it comes to 3D acceleration, etc.

These days there are 4 main BSDs. Free which you remember, Open for security maniacs, Net for those who want to run it on random things, Dragonfly is an experimental one.

It really is too bad that the BSD license by its nature doesn't require contributions especially where it would have been helpful. E.g. Sony uses BSD in the PlayStation which has a WiFi driver stack.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#277

Post by akdev1l »

simoncion wrote: post #273
akdev1l wrote: post #269

Earlier quoted context omitted.

The context is that on a traditional Linux laptop/desktop you are in fact running everything as one user. Firefox, the desktop environment, your password manager and even `sudo` are traditionally all running as your own user. This is not true in Android whatsoever. Being multi-seat or not has little security implications - most traditional Linux systems can handle multi-seat but they’re still limited in security by r…

> The context is that on a traditional Linux laptop/desktop you are in fact running everything as one user. Um. Have you ever run 'ps aux', guy? At minimum you're running everything as two users (root and your user account), and probably three to twenty more, depending on what you have installed. I know that on my desktop system ps axo user | sort -u | grep -v USER | wc -l returns 12. Even back in the late 1990s/earl…

are you linking to the fact that “useradd” exists to prove your point…?

Lmfaoooo

I’m assuming you have actually never ran a linux on your desktop. Lmaooooo.

Yeah sure init runs as root, and maybe you have background services that run as some other user.

BUT YOUR ACTUAL DESKTOP SESSION RUNS AS ONE USER. THIS INCLUDES YOUR BROWSER, YOUR PASSWORD MANAGER AND ALL YOUR OTHER SHIT!

https://paste.centos.org/view/f8e5ec76

so multi-user much secure

You know being a know-it-all only really works if you know what you are talking about.

Feel free to dig into the code of gnome-session if you don’t believe me.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#278

Post by udev4096 »

nullc wrote: post #255
udev4096 wrote: post #23

Earlier quoted context omitted.

Qubes is definitely hard to daily drive. With it's ancient default XFCE design, it looks really ugly. Plus no hardware acceleration

I think XFCE is much more attractive and usable than gnome stuff. In particular the buttons have borders so you can actually find them. Video performance is a fair criticism for sure. But is perpetual 0day RCE's in browsers and other highly exposed software is not running Qubes really a credible choice?

Sure, assess the threat model. I would also take security over convenience anytime, just like you proposed. But for normal users, it's not that simple. I use qubes in my testbox, I love it but it's still quite niche and sadly, far from hitting mainstream

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#279

Post by udev4096 »

fsflover wrote: post #59
udev4096 wrote: post #23

Earlier quoted context omitted.

Qubes is definitely hard to daily drive. With it's ancient default XFCE design, it looks really ugly. Plus no hardware acceleration

What's hard about it exactly? It's my daily driver. You can install KDE, too: https://forum.qubes-os.org/t/kde-changing-the-way-you-use-qu...

More power usage, need at least 64G of ram to even remotely use it as it's intended, no hardware acc by default, buggy templates, sleep is broken, uses X11 for display, dom0 is not updated as frequently as it should be and I hardly see any effort in documenting the fact that individual VMs's security matter too. That is not to say I hate Qubes. I think everyone, especially people dealing with sensitive data, should use it

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#280

Post by udev4096 »

nullc wrote: post #255
udev4096 wrote: post #23

Earlier quoted context omitted.

Qubes is definitely hard to daily drive. With it's ancient default XFCE design, it looks really ugly. Plus no hardware acceleration

I think XFCE is much more attractive and usable than gnome stuff. In particular the buttons have borders so you can actually find them. Video performance is a fair criticism for sure. But is perpetual 0day RCE's in browsers and other highly exposed software is not running Qubes really a credible choice?

On a separate note, I stalked your site and it seems you worked on bitcoin. I would love to hear about it, was it the early days?
Post reply on HN