Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Cloudflare responded to the “Copy Fail” Linux vulnerability

blog.cloudflare.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#71

Post by tptacek »

js2 wrote: post #69
tptacek wrote: post #59

This is an interesting post from Cloudflare, as usual, but it's not clear to me why they would have been vulnerable to CopyFail. Did I miss the point in this blog where that's addressed? What triggered the threat hunting and mitigation exploit? At what points in their architecture were they reliant on Linux user-based access control?

They weren't vulnerable to it in anything but an academic sense. They call that out up front: "There was no impact to the Cloudflare environment, no customer data was at risk, and no services were disrupted at any point." This was probably written by their security team. Security teams are paranoid. They want everything patched everywhere all at once at a severity level zeo. Also, PR. Also, also, if through some lack…

Yeah I think what I'm trying to clarify here is: are they doing a threat hunting exercise out of concern for multitenant exposures, or out of concern for internal privilege escalation?

Cross-tenant would be very surprising! But I don't know enough about their architecture.

It's weird, right? The underlying CNE primitive here, for CopyFail, is not novel. These happen all the time. Why the announcement? Is it just because CopyFail got so much attention?

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#72

Post by fragmede »

tptacek wrote: post #71
js2 wrote: post #69

Earlier quoted context omitted.

They weren't vulnerable to it in anything but an academic sense. They call that out up front: "There was no impact to the Cloudflare environment, no customer data was at risk, and no services were disrupted at any point." This was probably written by their security team. Security teams are paranoid. They want everything patched everywhere all at once at a severity level zeo. Also, PR. Also, also, if through some lack…

Yeah I think what I'm trying to clarify here is: are they doing a threat hunting exercise out of concern for multitenant exposures, or out of concern for internal privilege escalation? Cross-tenant would be very surprising! But I don't know enough about their architecture. It's weird, right? The underlying CNE primitive here, for CopyFail, is not novel. These happen all the time. Why the announcement? Is it just beca…

I can upload arbitrary code to Cloudflare workers, which they run on their systems. It's sandboxed, but in the big bad Internet, if you were Cloudflare, how much would you really trust that sandbox?

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#73

Post by tptacek »

fragmede wrote: post #72
tptacek wrote: post #71

Earlier quoted context omitted.

Yeah I think what I'm trying to clarify here is: are they doing a threat hunting exercise out of concern for multitenant exposures, or out of concern for internal privilege escalation? Cross-tenant would be very surprising! But I don't know enough about their architecture. It's weird, right? The underlying CNE primitive here, for CopyFail, is not novel. These happen all the time. Why the announcement? Is it just beca…

I can upload arbitrary code to Cloudflare workers, which they run on their systems. It's sandboxed, but in the big bad Internet, if you were Cloudflare, how much would you really trust that sandbox?

It's not running with direct access to Linux kernel system calls, is it?

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#74

Post by saurik »

js2 wrote: post #68
HDBaseT wrote: post #67

Earlier quoted context omitted.

I don't understand your point. You seem so pressed on the fact "why would they even patch this!!!", maybe because its best practice to patch things? You never known what things could be chained together, so you might as well patch this, given its so obviously bad.

That's a straw man and not what he asked. Literally, he asked: "why they would have been vulnerable to CopyFail?" I've been a sysadmin/programmer since the mid-90s. Local root exploits are a dime a dozen. If your infrastructure relies upon the tenuous difference between root and non-root accounts, you've already lost. Cloudflare isn't an ISP handing out shell accounts on Unix machines. So again, yes, of course you sh…

I mean, in some sense, Cloudflare simply accepts the security posture of "already lost", right? They run workloads for multiple users within the same process separated by nothing more than V8 boundaries, which even Chrome (which always claimed to run tabs in separate processes but actually didn't due to various edge cases) finally stopped doing (now afaik they do fence origins within processes) as it was so risky... Cloudflare's best lines of defense past "we patch often" are merely that they sort of KYC at least most of their users so they can log everything they run with their identity and that they take users of similar trust levels (age of account, level of KYC, amount of usage, etc.) and group those into processes... but, at the end of the day, they rely on something that I would certainly never consider reasonable to ship in production.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#75

Post by antonvs »

sammy2255 wrote: post #17

Any Cloudflare employees reading this, your network map has a few PoPs missing from it https://www.cloudflare.com/network/ notably, Perth (PER) Australia. Hobart (HBA) Australia. Wellington (WLG), New Zealand. Christchurch (CHC), New Zealand. Nausori (SUV), Fiji.

Perhaps those aren’t Cloudflare PoPs, they’re attacker MitM/honeypots.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#76

Post by sammy2255 »

antonvs wrote: post #75
sammy2255 wrote: post #17

Any Cloudflare employees reading this, your network map has a few PoPs missing from it https://www.cloudflare.com/network/ notably, Perth (PER) Australia. Hobart (HBA) Australia. Wellington (WLG), New Zealand. Christchurch (CHC), New Zealand. Nausori (SUV), Fiji.

Perhaps those aren’t Cloudflare PoPs, they’re attacker MitM/honeypots.

[flagged]

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#78

Post by trollbridge »

gilrain wrote: post #24
trollbridge wrote: post #7

Earlier quoted context omitted.

Starting a title with “How” is standard clickbait.

Starting a sentence with “How” is standard English, too.

Much of clickbait is standard English. HN takes a policy of applying editorial discretion to headlines, which makes the site more valuable.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#79

Post by js2 »

saurik wrote: post #74
js2 wrote: post #68

Earlier quoted context omitted.

That's a straw man and not what he asked. Literally, he asked: "why they would have been vulnerable to CopyFail?" I've been a sysadmin/programmer since the mid-90s. Local root exploits are a dime a dozen. If your infrastructure relies upon the tenuous difference between root and non-root accounts, you've already lost. Cloudflare isn't an ISP handing out shell accounts on Unix machines. So again, yes, of course you sh…

I mean, in some sense, Cloudflare simply accepts the security posture of "already lost", right? They run workloads for multiple users within the same process separated by nothing more than V8 boundaries, which even Chrome (which always claimed to run tabs in separate processes but actually didn't due to various edge cases) finally stopped doing (now afaik they do fence origins within processes) as it was so risky...…

> They run workloads for multiple users within the same process

Ah, then the root/non-root distinction means even less. They don't even distinguish between non-root accounts! Again, I'm not arguing against them defensively patching their systems against known exploits—they'd be crazy not to; just agreeing with Thomas that they can't be relying upon protecting root from non-root accounts as part a normal operational security boundary.

To wit: if an attacker escapes V8, it's unclear that leveraging "Copy Fail" to escape from non-root to root buys the attacker a whole lot more.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#80

Post by js2 »

fragmede wrote: post #72
tptacek wrote: post #71

Earlier quoted context omitted.

Yeah I think what I'm trying to clarify here is: are they doing a threat hunting exercise out of concern for multitenant exposures, or out of concern for internal privilege escalation? Cross-tenant would be very surprising! But I don't know enough about their architecture. It's weird, right? The underlying CNE primitive here, for CopyFail, is not novel. These happen all the time. Why the announcement? Is it just beca…

I can upload arbitrary code to Cloudflare workers, which they run on their systems. It's sandboxed, but in the big bad Internet, if you were Cloudflare, how much would you really trust that sandbox?

Let's say an attacker escapes the sandbox and gets a local non-root shell on the machine. At that point, how much more access does escaping to root gain the attacker? (This is a rhetorical question. Cloudflare doesn't say, which I think is the point of this line of questioning.)
Post reply on HN