5 ms·

Nasty Linux Bug, CVE-2024-1086, is on the loose

40 points by CrankyBear 2y ago

lyu07282 2y ago
The published exploit doesn't clean up after the exploitation to cause a kernel panic intentionally, but I suppose that didn't stop many people... > The kernel panic (system crash) after running the exploit is a side-effect which deliberately hasn't been fixed to prevent malicious usage of the exploit (i.e. exploitation attempts should now be more noticable, and unpractical in real-world operations). Despite this, it still allows for a working proof-of-concept in lab environments, as the root shell is functional, and persistence through disk is possible. https://github.com/Notselwyn/CVE-2024-1086 https://github.com/Notselwyn/CVE-2024-1086
fragmede 2y ago
Are there places that still give out shell accounts to untrusted users on shared Linux systems? There must still be at like research institutes or colleges, but these days most everyone gets their own VM. Local priv esc is something to patch for, but if you're accepting untrusted user input, you cycle the container after after N minutes/requests and the VM it's on after M minutes/requests to protect against this sort of thing.
- malux85 2y ago
  Local privilege escalation isnt just a problem on shell account sharing - it turns a "this image uploader has a weird RCE" into "I have root and compromised the application server, stole the database credentials and moved laterally through the network", thats why they still have relativly high (>=7) CVE scores
  - technion 2y ago
    The majority of the time its the same problem though. An rce in an image uploader running as your Web apps user will almost always allow me access to your database, since that web app uses that database by definition.
    - deleted 2y ago
      [deleted]
    - malux85 2y ago
      And root means you can hide your tracks easier, find IDS, install secondary backdoors, and a zillion other things that a normal user can’t do It’s only the same thing if you’re some ham-fisted script kiddie stealing the database, loudly in broad daylight. the pros stay unseen.
- delfinom 2y ago
  I'll blow your mind. Shared web hosts are still a thing.
  - fragmede 2y ago
    Now that you mention it, I have a friend on GoDaddy that has a thing they can SSH into and get some sort of shell on, probably via Virtuozzo or something.
rurban 2y ago
https://pwning.tech/nftables/ https://pwning.tech/nftables/ is the required reading for this exploit
justinclift 2y ago
Weirdly, the article doesn't give the fixed kernel versions for Ubuntu with the HWE kernel.

40 points by CrankyBear 2y ago

The published exploit doesn't clean up after the exploitation to cause a kernel panic intentionally, but I suppose that didn't stop many people... > The kernel panic (system crash) after running the exploit is a side-effect which deliberately hasn't been fixed to prevent malicious usage of the exploit (i.e. exploitation attempts should now be more noticable, and unpractical in real-world operations). Despite this, it still allows for a working proof-of-concept in lab environments, as the root shell is functional, and persistence through disk is possible. https://github.com/Notselwyn/CVE-2024-1086 https://github.com/Notselwyn/CVE-2024-1086

fragmede 2y ago

Are there places that still give out shell accounts to untrusted users on shared Linux systems? There must still be at like research institutes or colleges, but these days most everyone gets their own VM. Local priv esc is something to patch for, but if you're accepting untrusted user input, you cycle the container after after N minutes/requests and the VM it's on after M minutes/requests to protect against this sort of thing.

malux85 2y ago
Local privilege escalation isnt just a problem on shell account sharing - it turns a "this image uploader has a weird RCE" into "I have root and compromised the application server, stole the database credentials and moved laterally through the network", thats why they still have relativly high (>=7) CVE scores
- technion 2y ago
  The majority of the time its the same problem though. An rce in an image uploader running as your Web apps user will almost always allow me access to your database, since that web app uses that database by definition.
  - deleted 2y ago
    [deleted]
  - malux85 2y ago
    And root means you can hide your tracks easier, find IDS, install secondary backdoors, and a zillion other things that a normal user can’t do It’s only the same thing if you’re some ham-fisted script kiddie stealing the database, loudly in broad daylight. the pros stay unseen.
delfinom 2y ago
I'll blow your mind. Shared web hosts are still a thing.
- fragmede 2y ago
  Now that you mention it, I have a friend on GoDaddy that has a thing they can SSH into and get some sort of shell on, probably via Virtuozzo or something.

rurban 2y ago

https://pwning.tech/nftables/ https://pwning.tech/nftables/ is the required reading for this exploit

justinclift 2y ago

Weirdly, the article doesn't give the fixed kernel versions for Ubuntu with the HWE kernel.