9 ms·
Exploiting the Linux kernel via packet sockets
- googsh0tz 10y agoYou know, like I said the intel thing.
- AnimalMuppet 10y agoI don't think this is related to the Intel thing at all. It's not technically related, and it's not related in terms of severity.
- dom0 10y agoEither has headlines made of words, so that's something.
- lowbloodsugar 10y agoSuch great education material.
- tener 10y agoGreat read as usual. They are doing a big service to the people out there by hunting bugs like this one and putting the pressure on the vendors to fix their products.
- Achshar 10y agoI wish I was smart enough for the article. 8 years of web dev doesn't make the cut unfortunately.
- dyjakan 10y agoYou are smart enough but you have different priorities. This isn't magic but it does require time and time is usually spent on things people like. Therefore you just don't _like it_ enough.
- vvggff 10y agoWhy the comment of dyjakan was marked as dead?
- tyingq 10y agoIt's just domain knowledge and terminology. "Packet sockets" is shorthand for the AF_PACKET type sockets in Linux that let you construct network packets from the ground up, including the ethernet header, if you so wish. That's as opposed to a regular socket, which is higher level and restricts you to a much smaller subset of things you can change/set. The article just shows how they uncovered an exploit by "fuzzing" input to packet sockets. Where "fuzzing" just means using a tool that creates random inputs/values.
- Achshar 10y agoThe concept I think I can still get my head around. It's all the stuff that surrounds it that eludes me. I have done some work in C but that C is unlike any of the C I wrote in college (duh, it's the kernel code)
- tyingq 10y agoI don't see what you mean. It's a long line, so it breaks across 3 lines, but otherwise, it's just: if (a >= b && (int)(c - MACRO(d)) <= 0) goto out; Or the stuff further down? Just confusing because tpacket_req and friends are defined as structs elsewhere, so you don't have that context. And it's not really C, it's syzkaller (fuzzing tool) descriptions, kind of a pseudo code syntax.
- _jordan 10y agoyeah webapps in general are the most simple aspect of programming that you can get paid to do. Not knocking it though
- yeukhon 10y ago(and I can't do any frontend work). Every job has its own difficulties and its own obstacles. off-topic, btw, I read tpacket == tptacek. He can easily hide in Linux kernel. No one noticed, until now.
- schoen 10y agoHey, it's an anagram! I believe that the serial device /dev/ttyS0 was named in honor of Theodore Ts'o. So maybe tpacket could be at least retroactively declared to honor tptacek.
- BenjiWiebe 10y agoI personally find embedded programming easier than web development...
- _jordan 10y agoBut isn't embedded programming more complex? as in, it requires a well founded understanding of CS concepts, as well as requires advanced ability in programming and math.
- tyingq 10y agoI imagine to an embedded developer, the web just looks like madness because there's no consistency. Parachute into a web app you've never seen before, one that might not have been developed well. Your task is to make a button that's currently green and make it blue instead. What's the right file(s) to edit? How many layers of caching do you need to disable to see that your change actually worked? Do you need to restart anything after the change for it to be seen? The current green color could be: - in a css file, but one that has to go through SAAS/LESS first, or maybe not. Or maybe there's more than one entry, depending on @media screen resolution? Or maybe it's not a file at all...the css "file" is generated on the fly by some server-side framework. - in an html file, but in <style> tags. Or maybe dynamically generated style tags via client side javascript. Or maybe server-side dynamically generated style tags? Or maybe not style tags at all? Perhaps a style attribute on the button. - Or hey, that looks like a button, but it's not a button at all. It's an <a> tag with button styling. And it's green, but only because of a background image. Which is loaded how (static css? dynamic js style manipulation? inline <img> tag in the <a>? something else?)
- fencepost 10y agoSomeone correct me if I'm wrong: This is a locally exploitable privilege escalation involving creation of the socket, triggerable from user level, so exploitable by local users or as a followup after another exploit is used to get some level of local access, correct?
- eyalm 10y agoNot really. Requires to have the CAP_NET_RAW capability, which is pretty rare. (This capability allows you raw access to the network interface, which is usually only given to the root user)
- fencepost 10y agoThanks, I was a bit concerned at first when I saw the 4 words "Exploiting Linux kernel packet" on one line, but as a privilege escalation after a first exploit I won't worry as much about it.
- scarybeast 10y agoNo. It's exploitable by a normal unprivileged user on modern Ubuntu. From the article, "Let’s see how we can exploit this vulnerability. I’m going to be targeting x86-64 Ubuntu 16.04.2 with 4.8.0-41-generic kernel version with KASLR, SMEP and SMAP enabled. Ubuntu kernel has user namespaces available to unprivileged users (CONFIG_USER_NS=y and no restrictions on it’s usage), so the bug can be exploited to gain root privileges by an unprivileged user."
- eyalm 10y agoBottom line - locally exploitable vulnerability in the linux kernel, in case you have the CAP_NET_RAW capability which never really happens. Not a real security threat for your standard linux distro. On the other hand, this is a great technical write-up that describes thoroughly the internals of some of the linux kernel subsystems. Probably the best documentation you can find for some subsystems. Also shows how they bypassed exploit mitigations technics such as KASLR, SMAP&SMEP.
- dohqu8Zi 10y agoNo. Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.
- d33 10y agoThat's pretty interesting. Does it mean it allows escaping Docker containers if you compromise a service ran as root in it?
- dohqu8Zi 10y agoNo, Docker usually drops CAP_NET_RAW within the container. But you can change that and other container technologies definitely keep CAP_NET_RAW within the container.
- dohqu8Zi 10y agoBTW: Depending on the configuration you can create a new namespace within Docker to gain CAP_NET_RAW since namespaces can nest.
- wrongmmmm 10y agoNot true. CAP_NET_RAW is on by default: https://github.com/moby/moby/blob/master/oci/defaults_linux.go#L62-L77 https://github.com/moby/moby/blob/master/oci/defaults_linux.... Otherwise no one could ping from a container.
- thesz 10y agoIs is only me who remembered that [1] piece of parody? [1] http://web.mit.edu/adorai/www/seuss-technical-writing.html http://web.mit.edu/adorai/www/seuss-technical-writing.html
- est 10y agoSo are there any Android binaries have CAP_NET_RAW so I can root the device?
- yjftsjthsd-h 10y agoPing?