4 ms·

Ubuntu 16.04 LTS 0day priv escalation

19 points by ll0rtagem 9y ago

https://twitter.com/vnik5287/status/974439706896187392 http://cyseclabs.com/exploits/upstream44.c

ekvintroj 9y ago
This is from 2016 actually https://www.exploit-db.com/exploits/39772/ https://www.exploit-db.com/exploits/39772/
- ll0rtagem 9y ago
  nah that's unrelated. the bug is not a memory corruption
compsciphd 9y ago
well, it definitely works on my own box.
laci27 9y ago
To ALL security 'researchers' out there: PLEASE don't disclose 0day's before they where fixed by the project owners!
laci27 9y ago
There should really be a law against this sort of thing. Security researchers are needed and they provide a valuable service to the world, but please don't get ahead of yourselfs. In recent months there were many instances where people just disclosed vulnerabilities without making sure there are fixed available. This is wrong and legally should be equivalent to hacking. In the past, when vulnerabilities with no fixes were disclosed were after months and months of trying to contact the developers of said software and patch it... Nowadays it seems everyone is eager to ride their 15 minutes of fame...SAD :)
- bell0x07 9y ago
  I agree that everybody needs to follow responsible disclosure practices. I think you are confusing two terms, braking the law and hacking. While hacking can be braking the law, most often it is not. Not all hackers are criminals.
- ll0rtagem 9y ago
  I think the fix is in the tweet. The bug is fixed in the staging kernel and it shows how to install it?
  - lampington 9y ago
    The problem is that it's a staging kernel, not a full release. I've not been able to get it to boot on m3.large AWS instances, though it seems to work on xlarge.
AstralStorm 9y ago
Another exploit against a kernel space firewall language interpreter. Why is this even enabled in Ubuntu?
vicaya 9y ago
To disable this class of exploits (bugs in unprivileged bpf) without installing a new kernel: echo 1 | sudo tee /proc/sys/kernel/unprivileged_bpf_disabled

19 points by ll0rtagem 9y ago

https://twitter.com/vnik5287/status/974439706896187392 http://cyseclabs.com/exploits/upstream44.c

ekvintroj 9y ago

This is from 2016 actually https://www.exploit-db.com/exploits/39772/ https://www.exploit-db.com/exploits/39772/

ll0rtagem 9y ago
nah that's unrelated. the bug is not a memory corruption

compsciphd 9y ago

well, it definitely works on my own box.

laci27 9y ago

To ALL security 'researchers' out there: PLEASE don't disclose 0day's before they where fixed by the project owners!

laci27 9y ago

There should really be a law against this sort of thing. Security researchers are needed and they provide a valuable service to the world, but please don't get ahead of yourselfs. In recent months there were many instances where people just disclosed vulnerabilities without making sure there are fixed available. This is wrong and legally should be equivalent to hacking. In the past, when vulnerabilities with no fixes were disclosed were after months and months of trying to contact the developers of said software and patch it... Nowadays it seems everyone is eager to ride their 15 minutes of fame...SAD :)

bell0x07 9y ago
I agree that everybody needs to follow responsible disclosure practices. I think you are confusing two terms, braking the law and hacking. While hacking can be braking the law, most often it is not. Not all hackers are criminals.
ll0rtagem 9y ago
I think the fix is in the tweet. The bug is fixed in the staging kernel and it shows how to install it?
- lampington 9y ago
  The problem is that it's a staging kernel, not a full release. I've not been able to get it to boot on m3.large AWS instances, though it seems to work on xlarge.

AstralStorm 9y ago

Another exploit against a kernel space firewall language interpreter. Why is this even enabled in Ubuntu?

vicaya 9y ago

To disable this class of exploits (bugs in unprivileged bpf) without installing a new kernel: echo 1 | sudo tee /proc/sys/kernel/unprivileged_bpf_disabled