Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dirty Frag: Universal Linux LPE

openwall.com

Post reply on HN
Print view View original

361–370 of 370 posts

Re: Dirty Frag: Universal Linux LPE

#361

Post by ActorNightly »

cluckindan wrote: post #156
ActorNightly wrote: post #135

Earlier quoted context omitted.

Because in order to exploit this, you have to have direct access to the computer. Either through malicious usb device, or by exploiting some supply chain or a known piece of software that will be willingly or automatically installed, and furthermore you need to be able to essentially run arbitrary terminal commands, which is a huge breach of isolation in that software. If an attacker manages to do all that, its alrea…

So a threat actor buys access to a managed kubernetes service, or other linux-based shared hosting platform, and now they have access to the computer. Hell, GitHub Actions would do.

Yes, because hypervisors are simply just a program that runs under linux, not total cpu/memory isolation......

Lemme guess, you probably think this can be used to hack into the backend that runs AWS from any EC2 lol?

Re: Dirty Frag: Universal Linux LPE

#363

Post by yencabulator »

zbentley wrote: post #171
reisse wrote: post #153

Earlier quoted context omitted.

No embargo exists (or could possibly exist) in the first place. Linux is open source, so every patch fixing the security bug is immediately visible to everyone. There is no workaround to that by the very design how the kernel is developed. The "embargo" people talking about is the rather stupid notion that if people keep their mouth shut and not write "THIS IS A LPE" straight in the patch description, everyone can pr…

My (novice) understanding is that embargoes are intended to provide time to 1) develop a patch and 2) distribute the patch. For Linux/public open source, what you said is right about 2). Once the patch is visible to anyone, it's trivial to identify exploits for unpatched systems. But 1) is still a valid use-case for embargoes for Linux vulns, right? Like, if this patch had taken a few weeks to develop before being co…

Someone developed the patch and got it merged, so the timeline was past the 1) embargo that Linux can structurally have: https://openwall.com/lists/oss-security/2026/05/07/12

Re: Dirty Frag: Universal Linux LPE

#364

Post by yencabulator »

Sohcahtoa82 wrote: post #69
xxpor wrote: post #30

Linux is a single user system and should be treated as such. Run your services as root. Don't rely on unix user primitives for security.

This carries the same energy as "People will break into your car no matter what, so just leave your doors unlocked."

This actually happened to me. The seats had moved and glovebox was open one morning. Then a second break-in a few days later, and this one damaged the door panel near the lock. I left the doors unlocked for a couple of weeks after, to decrease the break-in damage -- there was never anything of value in the vehicle.

Re: Dirty Frag: Universal Linux LPE

#365

Post by angry_octet »

0123456789ABCDE wrote: post #341
angry_octet wrote: post #227

Earlier quoted context omitted.

Yes that is reasonable, but dispensing with all on machine controls is not.

isn't root level access one of the selling points of the cloud vm product line?

That doesn't mean you should run your services as root, it means other users are not sharing your machine/ kernel.

Re: Dirty Frag: Universal Linux LPE

#366

Post by grosswait »

pjmlp wrote: post #236
esseph wrote: post #55

Earlier quoted context omitted.

https://www.androidpolice.com/google-support-linux-kernels-a... Google relies on Linux LTS kernels. When the Linux LTS team dropped support from 6 years down to 2 years, Google stepped in to cover the 4-year gap. It is Linux. It's basically a distro.

When people say Linux they mean GNU/Linux.

Maybe. Depends on context, and in this case the context means, no I do not mean GNU/Linux

Re: Dirty Frag: Universal Linux LPE

#367

Post by grosswait »

esseph wrote: post #340
cyphar wrote: post #241

Earlier quoted context omitted.

In common parlance, yes -- because there is no practical distinction. But in cases where something is just using the Linux kernel without GNU and other common userpand components (and there is a practical distinction) then it's definitionally untrue to say that it's "not Linux" if you really meant to say "it's not GNU/Linux".

I've always thought this was extremely interesting: https://chimera-linux.org/

That is indeed interesting!

Re: Dirty Frag: Universal Linux LPE

#369

Post by jguarnelli »

cyphar wrote: post #238
stsewd wrote: post #183

Earlier quoted context omitted.

I got the same running it inside a container, but got a shell when running it directly in the host. This only shows that the exploit doesn't work inside a container. So, containers aren't vulnerable, or the script needs some adjustments to make it work in containers. Since copy fail can be used to escape containers ( https://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kuber... ), I'm guessing the exploit needs som…

The repo you linked works by replacing files that are being used by other privileged containers on the same system. That works for the Kubernetes case (I'm a little surprised they don't use static binaries for their own privileged containers, seems a little dangerous to share any kind of data with untrusted tenants even if it's read-only) but not standalone containers. However, there is a much an easier way of doing…

[dead]

Re: Dirty Frag: Universal Linux LPE

#370

Post by akimbostrawman »

mike_hearn wrote: post #273
croes wrote: post #262

Earlier quoted context omitted.

Is it? The claim is Android is much more secure than other Linux, but if 40% of all Android devices don‘t get a security patch and you can’t even do it yourself I would call the more secure per se. Hardening is one part of security, patchability another. Android lacks in the latter.

So what? Most devices running Linux don't get security patched, it was ever thus. Think about all the kernels running in wifi routers and other embedded devices.

Your outdated linux is not reachable world wide by a public phone number. Once again phones do not have the same threat model as desktops. try running your outdated Linux without a firewall and see how long that will survive.
Post reply on HN