311–320 of 370 posts
Earlier quoted context omitted.
It's not always as easy as you imply. All the attack vectors you mentioned, require root on the host, before you can make the change or install the trojan.
The attack gives you ability to overwrite any cached page. So you don't need to be root to "edit" /etc/passwd.
Ran as a fresh new default user in a ubuntu:latest container git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp Result: dirtyfrag: failed (rc=3) Good news!
I got the same running it inside a container, but got a shell when running it directly in the host. This only shows that the exploit doesn't work inside a container. So, containers aren't vulnerable, or the script needs some adjustments to make it work in containers. Since copy fail can be used to escape containers ( https://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kuber... ), I'm guessing the exploit needs som…
Looks like the esp4 and esp6 fixes have been pushed for 7.0, 6.18, 6.12 and 6.6 kernels. https://lore.kernel.org/lkml/2026050851-iron-hurdle-6421@gre... https://lore.kernel.org/lkml/2026050843-unplowed-spinster-cf... https://lore.kernel.org/lkml/2026050832-remold-faceless-bed0... https://lore.kernel.org/lkml/2026050825-heaving-spender-13a8...
And again it's band-aiding the problem. Can authencesn not be fixed or what?
After all these years, we finally have enough eyeballs that all bugs are shallow, and it kinda sucks. How many times a week am I going to be updating my kernel from now on?
I haven't updated mine. I have a firewall and it's not exposed to the Internet. Need a key to SSH in. Same with my public facing server. Almost none of these exploits are "drop everything now and patch" unless you are somehow exposing yourself stupidly.
But this kind of thinking can be dangerous because it implies that your systems don't talk to the outside world at all, which they obviously do. I mean a very glaring example is container images, so it definitely takes more than a firewall and ssh keys to stay safe in general.
Earlier quoted context omitted.
Are they already vulnerable to RCE as an unprivileged user? Hopefully not. An LPE only allows an attacker who can already execute code on the system to become root. So, bad, yes, but it doesn't mean you are immediately pwned.
And for a single user desktop, an LPE is almost meaningless as all the really important files are in $HOME and accessible without root.
This is very similar in root cause and exploitation to Copy Fail. Which illustrates pretty well something that's lost when relying heavily on LLMs to do work for you: exploration. I find that doing vulnerability research using AI really hinders my creativity. When your workflow consists of asking questions and getting answers immediately, you don't get to see what's nearby. It's like a genie - you get exactly what yo…
> When your workflow consists of asking questions and getting answers immediately, you don't get to see what's nearby. Very much aligns with my experience. For me this is the most unsatisfying thing about AI-based workflows in general, they miss stuff humans would never miss. All the time I wonder what am I missing that's right nearby? It's remarkable how many times I have to ask Claude code to fully ingest something…
Earlier quoted context omitted.
>if 40% of all Android devices don‘t get a security patch No system will stay secure once it does not receive updates. That does not exclude it from being more secure than another system based on security feature merits as long as it does get updated. >Hardening is one part of security, patchability another. Android lacks in the latter. That is not an inherent flaw with android but OEM devices shipping modified andro…
It is an inherent flaw of android. Imagine no Windows update because Lenovo stopped support for 4 year old notebooks