3 ms·

I think it's misleading to label this "Debian/Ubuntu privilege escalation"; it's a Linux kernel local exploit, that happens to be confirmed to apply to Debian a

I think it's misleading to label this "Debian/Ubuntu privilege escalation"; it's a Linux kernel local exploit, that happens to be confirmed to apply to Debian and Ubuntu. (Edit: Because when I read "Debian/Ubuntu privilege escalation PoC exploit for CVE-2024-1086" my first thought was something like, "Oh, is it in apt-get? Or is this another distro patch gone wrong?")

KennyBlanken 3y ago
[flagged]
- jvanderbot 3y ago
  > Don't criticize a title based on a barely-15-seconds-examination of something. Suggest removing this, it's overly-reproachful and GP comment be explained by being less knowledgeable, busy, under-caffeinated, etc. Your comment is highly informative for those who had similar thoughts - no reason to make it negative in nature.
  - KennyBlanken 3y ago
    [flagged]
    - jvanderbot 3y ago
      You are free to attempt to enforce a price-of-admission to comment. I attempt to use the up/down vote to filter rather than reproach. I feel it's more in the spirit of HN. I appreciate you providing context to your thought process, and I am only doing so similarly for transparency. I think we can politely disagree about approach and go on our way now. Have a good day!
- dang 3y ago
  If you keep posting personal attacks, we're going to have to ban you. I don't want to ban you—you're a knowledgeable user who has posted good things. But we've warned you a whole bunch of times already, the slack can't be infinite, and no amount of good comments makes it ok to repeatedly poison the well. https://news.ycombinator.com/item?id=39111764 https://news.ycombinator.com/item?id=39111764 (Jan 2024) https://news.ycombinator.com/item?id=35416693 https://news.ycombinator.com/item?id=35416693 (April 2023) https://news.ycombinator.com/item?id=34606566 https://news.ycombinator.com/item?id=34606566 (Feb 2023) https://news.ycombinator.com/item?id=33292588 https://news.ycombinator.com/item?id=33292588 (Oct 2022) https://news.ycombinator.com/item?id=32729960 https://news.ycombinator.com/item?id=32729960 (Sept 2022) https://news.ycombinator.com/item?id=32729939 https://news.ycombinator.com/item?id=32729939 (Sept 2022) https://news.ycombinator.com/item?id=31842940 https://news.ycombinator.com/item?id=31842940 (June 2022) https://news.ycombinator.com/item?id=30436952 https://news.ycombinator.com/item?id=30436952 (Feb 2022) https://news.ycombinator.com/item?id=30433141 https://news.ycombinator.com/item?id=30433141 (Feb 2022) https://news.ycombinator.com/item?id=28948931 https://news.ycombinator.com/item?id=28948931 (Oct 2021) If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
wiredfool 3y ago
Also, it's already been patched and the vulnerable are the ones who haven't updated.
- krylon 3y ago
  Thanks for pointing that out, I was confused about that.
- pajko 3y ago
  The world was given a pretty short time frame to adapt. Now the script kiddies will unleash the hell.
  - eikenberry 3y ago
    It was patched a month and a half ago which means it was known about before that. So around 30ish days known until the CVE and 60 until this published exploit. IMO this is a decent time frame, how long do you think is enough?
freedomben 3y ago
You're not necessarily wrong, although simply saying "Linux" isn't accurate either because it's in part a vuln exposed by a specific kconfig, which differs by distro. From the caveats section: > The exploit does not work v6.4> kernels with kconfig CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y (including Ubuntu v6.5) > The exploits requires user namespaces (kconfig CONFIG_USER_NS=y), that those user namespaces are unprivileged (sh command sysctl kernel.unprivileged_userns_clone = 1), and that nf_tables is enabled (kconfig CONFIG_NF_TABLES=y). By default, these are all enabled on Debian, Ubuntu, and KernelCTF. Other distro's have not been tested, but may work as well. Also with other distros like Fedora and Arch, the kernel versions change frequently including new big versions (like 6.4 to 6.5, what in semver would be called "minor" but isn't super accurate for the linux kernel) so that list would be outdated very quickly if not immediately (for example my Fedora machine right now is on kernel 6.7.9, way beyond what is vulnerable). It's quite possible that Ubuntu is the only vulnerable distro given the way they manage kernel versions. That's not a criticism of Ubuntu, because there are pros and cons of each approach, but in this case it does probably make Ubuntu more vulnerable. RHEL and derivatives also tend to stick on a version long term, and it looks like RHEL 9.3 is on kernel 5.14 so could be vulnerable but it's at the very beginning of the range. That would be a useful thing to know. I think it's also (generally) far more useful for most people to hear a descriptor that most closely aligns with something they can readily identify whether it affects them or not. Then people can look at the details themselves. Edit: added a little more on other distros like Fedora and Arch
- candiddevmike 3y ago
  Interesting Arch discussion on the security implications of user namespaces when they were considering adding it to their kconfig: https://bugs.archlinux.org/task/36969 https://bugs.archlinux.org/task/36969
- yjftsjthsd-h 3y ago
  > simply saying "Linux" isn't accurate either because it's in part a vuln exposed by a specific kconfig, which differs by distro True; if the Debian family is unusual in having that config then fair enough, but it sounds like the author just didn't look at others. > Also with other distros like Fedora and Arch, the kernel versions change frequently including new big versions (like 6.4 to 6.5, what in semver would be called "minor" but isn't super accurate for the linux kernel) so that list would be outdated very quickly if not immediately Debian/Ubuntu still roll patch releases regularly, so that seems irrelevant; it'll be out of date in short order regardless.
dang 3y ago
We've changed the title from "Debian/Ubuntu privilege escalation PoC exploit for CVE-2024-1086" as part of changing the URL (see https://news.ycombinator.com/item?id=39830200 https://news.ycombinator.com/item?id=39830200)

KennyBlanken 3y ago

[flagged]

jvanderbot 3y ago
> Don't criticize a title based on a barely-15-seconds-examination of something. Suggest removing this, it's overly-reproachful and GP comment be explained by being less knowledgeable, busy, under-caffeinated, etc. Your comment is highly informative for those who had similar thoughts - no reason to make it negative in nature.
- KennyBlanken 3y ago
  [flagged]
  - jvanderbot 3y ago
    You are free to attempt to enforce a price-of-admission to comment. I attempt to use the up/down vote to filter rather than reproach. I feel it's more in the spirit of HN. I appreciate you providing context to your thought process, and I am only doing so similarly for transparency. I think we can politely disagree about approach and go on our way now. Have a good day!
dang 3y ago
If you keep posting personal attacks, we're going to have to ban you. I don't want to ban you—you're a knowledgeable user who has posted good things. But we've warned you a whole bunch of times already, the slack can't be infinite, and no amount of good comments makes it ok to repeatedly poison the well. https://news.ycombinator.com/item?id=39111764 https://news.ycombinator.com/item?id=39111764 (Jan 2024) https://news.ycombinator.com/item?id=35416693 https://news.ycombinator.com/item?id=35416693 (April 2023) https://news.ycombinator.com/item?id=34606566 https://news.ycombinator.com/item?id=34606566 (Feb 2023) https://news.ycombinator.com/item?id=33292588 https://news.ycombinator.com/item?id=33292588 (Oct 2022) https://news.ycombinator.com/item?id=32729960 https://news.ycombinator.com/item?id=32729960 (Sept 2022) https://news.ycombinator.com/item?id=32729939 https://news.ycombinator.com/item?id=32729939 (Sept 2022) https://news.ycombinator.com/item?id=31842940 https://news.ycombinator.com/item?id=31842940 (June 2022) https://news.ycombinator.com/item?id=30436952 https://news.ycombinator.com/item?id=30436952 (Feb 2022) https://news.ycombinator.com/item?id=30433141 https://news.ycombinator.com/item?id=30433141 (Feb 2022) https://news.ycombinator.com/item?id=28948931 https://news.ycombinator.com/item?id=28948931 (Oct 2021) If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.

wiredfool 3y ago

Also, it's already been patched and the vulnerable are the ones who haven't updated.

krylon 3y ago
Thanks for pointing that out, I was confused about that.
pajko 3y ago
The world was given a pretty short time frame to adapt. Now the script kiddies will unleash the hell.
- eikenberry 3y ago
  It was patched a month and a half ago which means it was known about before that. So around 30ish days known until the CVE and 60 until this published exploit. IMO this is a decent time frame, how long do you think is enough?

freedomben 3y ago

You're not necessarily wrong, although simply saying "Linux" isn't accurate either because it's in part a vuln exposed by a specific kconfig, which differs by distro. From the caveats section: > The exploit does not work v6.4> kernels with kconfig CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y (including Ubuntu v6.5) > The exploits requires user namespaces (kconfig CONFIG_USER_NS=y), that those user namespaces are unprivileged (sh command sysctl kernel.unprivileged_userns_clone = 1), and that nf_tables is enabled (kconfig CONFIG_NF_TABLES=y). By default, these are all enabled on Debian, Ubuntu, and KernelCTF. Other distro's have not been tested, but may work as well. Also with other distros like Fedora and Arch, the kernel versions change frequently including new big versions (like 6.4 to 6.5, what in semver would be called "minor" but isn't super accurate for the linux kernel) so that list would be outdated very quickly if not immediately (for example my Fedora machine right now is on kernel 6.7.9, way beyond what is vulnerable). It's quite possible that Ubuntu is the only vulnerable distro given the way they manage kernel versions. That's not a criticism of Ubuntu, because there are pros and cons of each approach, but in this case it does probably make Ubuntu more vulnerable. RHEL and derivatives also tend to stick on a version long term, and it looks like RHEL 9.3 is on kernel 5.14 so could be vulnerable but it's at the very beginning of the range. That would be a useful thing to know. I think it's also (generally) far more useful for most people to hear a descriptor that most closely aligns with something they can readily identify whether it affects them or not. Then people can look at the details themselves. Edit: added a little more on other distros like Fedora and Arch

candiddevmike 3y ago
Interesting Arch discussion on the security implications of user namespaces when they were considering adding it to their kconfig: https://bugs.archlinux.org/task/36969 https://bugs.archlinux.org/task/36969
yjftsjthsd-h 3y ago
> simply saying "Linux" isn't accurate either because it's in part a vuln exposed by a specific kconfig, which differs by distro True; if the Debian family is unusual in having that config then fair enough, but it sounds like the author just didn't look at others. > Also with other distros like Fedora and Arch, the kernel versions change frequently including new big versions (like 6.4 to 6.5, what in semver would be called "minor" but isn't super accurate for the linux kernel) so that list would be outdated very quickly if not immediately Debian/Ubuntu still roll patch releases regularly, so that seems irrelevant; it'll be out of date in short order regardless.

dang 3y ago

We've changed the title from "Debian/Ubuntu privilege escalation PoC exploit for CVE-2024-1086" as part of changing the URL (see https://news.ycombinator.com/item?id=39830200 https://news.ycombinator.com/item?id=39830200)