4 ms·

Looking at the exploit code [1], sadly, you don't... They're using the fact that you can become "root" in a new namespace. So you need cgroups. After that, you

Looking at the exploit code [1], sadly, you don't... They're using the fact that you can become "root" in a new namespace. So you need cgroups. After that, you're free to change NFTables in that namespace. I was just playing around with this: $ unshare -r --net --user capsh --print and comparing it to $ sudo capsh --print Both give you all caps. Exploiting a parser bug in NFTables doesn't require access to the main namespace; just something to get past the initial cap checks. (IIUC.) Edit: the commands above were run on Ubuntu 21.10. [1] https://github.com/randorisec/CVE-2022-34918-LPE-PoC/blob/main/src/util.c#L31 https://github.com/randorisec/CVE-2022-34918-LPE-PoC/blob/ma...

_8j50 4y ago
I didn't even think if namespaces! Thanks for clarifying.
- raesene9 4y ago
  It's worth noting that it is possible to disable unprivileged user namespaces, but the default on several modern linux distros is to have it enabled.
- tommiegannert 4y ago
  It's indeed a pretty cool combination of ideas to get to the final exploit. I just had a discussion about whether programming is mostly creative or analytical. Seeing this post, the answer (next time) will be "yes."
  - _8j50 4y ago
    I an sort of learning how to bypass ASLR right now, it is a very timely PoC for me.
majke 4y ago
Here's what my colleagues think about unpriviledged namespaces: https://blog.cloudflare.com/live-patch-security-vulnerabilities-with-ebpf-lsm/ https://blog.cloudflare.com/live-patch-security-vulnerabilit...
mmis1000 4y ago
> They're using the fact that you can become "root" in a new namespace That privilege can actually be taken away. But probably no one will do that unless you are hardening against specific situation. The linux caps has many level of access of a certain cap. For example: is it activated now? can it be activated by me? Will that be inherited by my children process? Can i regain it by su or creating new namespace? If you take away the last one. Then the process and any child process of specific process won't be able to regain the cap ever again. See also: capabilities(7) > Capabilities and execution of programs by root

_8j50 4y ago

I didn't even think if namespaces! Thanks for clarifying.

raesene9 4y ago
It's worth noting that it is possible to disable unprivileged user namespaces, but the default on several modern linux distros is to have it enabled.
tommiegannert 4y ago
It's indeed a pretty cool combination of ideas to get to the final exploit. I just had a discussion about whether programming is mostly creative or analytical. Seeing this post, the answer (next time) will be "yes."
- _8j50 4y ago
  I an sort of learning how to bypass ASLR right now, it is a very timely PoC for me.

majke 4y ago

Here's what my colleagues think about unpriviledged namespaces: https://blog.cloudflare.com/live-patch-security-vulnerabilities-with-ebpf-lsm/ https://blog.cloudflare.com/live-patch-security-vulnerabilit...

mmis1000 4y ago

> They're using the fact that you can become "root" in a new namespace That privilege can actually be taken away. But probably no one will do that unless you are hardening against specific situation. The linux caps has many level of access of a certain cap. For example: is it activated now? can it be activated by me? Will that be inherited by my children process? Can i regain it by su or creating new namespace? If you take away the last one. Then the process and any child process of specific process won't be able to regain the cap ever again. See also: capabilities(7) > Capabilities and execution of programs by root