3 ms·

> which probably means it's possible to use a malformed filesystem to get arbitrary code execution in the kernel. I'll concede that there are some older vulns

by rphlx 9y ago

> which probably means it's possible to use a malformed filesystem to get arbitrary code execution in the kernel. I'll concede that there are some older vulns allowing that, but if you meant for a reasonably up-to-date Linux or Win7+ system: reference needed.

mjg59 9y ago
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4913 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4913, for instance?
- rphlx 9y ago
  Thanks - didn't hear about that one.
  - mjg59 9y ago
    Filesystems are basically parsers that were only originally tested against well-formed input. Upstream Linux developers will happily tell you that you shouldn't allow untrusted users to mount filesystems (or trusted users to mount untrusted filesystems…), but unfortunately that's not really an option in the real world.
    - rphlx 9y ago
      Well, for the past 4+ years "arbitrary kernel code execution through mounting a malformed FS" has been considered a major security issue, and a lot of effort does go into finding and fixing stuff like that through fuzzing, code audits, static analysis, etc (for both Linux and Windows). I think it is fair to say that this class of vulns is declining in frequency, with the rate of discovery having peaked somewhere within 2008-2012.
      - mjg59 9y ago
        Eh. Bugs get fixed as they're found, but I don't see much evidence of it being taken into consideration when adding new code (in Linux, at least - it wouldn't surprise me if Windows were better in this respect)
        tinus_hn 9y ago
        If the attacker just provides a file system that contains setuid shells or unsecured device files, that's not really a bug and not remotely exploitable. But it's still a vulnerability.
        jabl 9y ago
        Hopefully filesystems mounted by normal users will have nosuid,nodev enforced (whoever is responsible for this these days, policykit??). Please tell me I'm correct...
        tmsldd 9y ago
        Yeah, that is right. A bug can only be fixed once it has been found.. the question now is whether the rate of bugs found is greater than the rate of insertion of new bugs (which I guess is proportional to the number of new lines of code). If not the future is going to be terrible.. :D

by rphlx 9y ago

mjg59 9y ago

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4913 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4913, for instance?

rphlx 9y ago
Thanks - didn't hear about that one.
- mjg59 9y ago
  Filesystems are basically parsers that were only originally tested against well-formed input. Upstream Linux developers will happily tell you that you shouldn't allow untrusted users to mount filesystems (or trusted users to mount untrusted filesystems…), but unfortunately that's not really an option in the real world.
  - rphlx 9y ago
    Well, for the past 4+ years "arbitrary kernel code execution through mounting a malformed FS" has been considered a major security issue, and a lot of effort does go into finding and fixing stuff like that through fuzzing, code audits, static analysis, etc (for both Linux and Windows). I think it is fair to say that this class of vulns is declining in frequency, with the rate of discovery having peaked somewhere within 2008-2012.
    - mjg59 9y ago
      Eh. Bugs get fixed as they're found, but I don't see much evidence of it being taken into consideration when adding new code (in Linux, at least - it wouldn't surprise me if Windows were better in this respect)
      - tinus_hn 9y ago
        If the attacker just provides a file system that contains setuid shells or unsecured device files, that's not really a bug and not remotely exploitable. But it's still a vulnerability.
        jabl 9y ago
        Hopefully filesystems mounted by normal users will have nosuid,nodev enforced (whoever is responsible for this these days, policykit??). Please tell me I'm correct...
      - tmsldd 9y ago
        Yeah, that is right. A bug can only be fixed once it has been found.. the question now is whether the rate of bugs found is greater than the rate of insertion of new bugs (which I guess is proportional to the number of new lines of code). If not the future is going to be terrible.. :D