2 ms·

from what I understand, CrowdStrike has essentially put a Turing-complete interpreter for their scripting language into the kernel. I doubt you can do much when

from what I understand, CrowdStrike has essentially put a Turing-complete interpreter for their scripting language into the kernel. I doubt you can do much when something is that general purpose.

capitainenemo 2y ago
Do you have more information on that? Hadn't read anything about the CS kernel module running arbitrary code. Was it a factor in the crash? 'course, Microsoft also put turing complete scripting in ring 0 years ago for performance reasons (TTFs - XML/HTML parsing and GUI rendering too - to beat other OSes apparently) and that certainly did lead to exploited vulnerabilities... https://googleprojectzero.blogspot.com/2016/07/a-year-of-windows-kernel-font-fuzzing-2.html https://googleprojectzero.blogspot.com/2016/07/a-year-of-win... https://gist.github.com/Nevor/ed3719dad0cf66893e42a9ba024c9174 https://gist.github.com/Nevor/ed3719dad0cf66893e42a9ba024c91... https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-040 https://learn.microsoft.com/en-us/security-updates/securityb... https://www.fortinet.com/blog/threat-research/one-bit-to-rule-them-all-bypassing-windows-10-protections-using-a-single-bit https://www.fortinet.com/blog/threat-research/one-bit-to-rul... https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2011/2639658?redirectedfrom=MSDN https://learn.microsoft.com/en-us/security-updates/SecurityA... https://news.ycombinator.com/item?id=9769099 https://news.ycombinator.com/item?id=9769099 (this comment in particular https://news.ycombinator.com/item?id=9783863 https://news.ycombinator.com/item?id=9783863)
jacobgorm 2y ago
It doesn’t matter if you are doing full Fault Isolation with XFI. I recommend reading the paper here https://www.usenix.org/legacy/event/osdi06/tech/full_papers/erlingsson/erlingsson.pdf https://www.usenix.org/legacy/event/osdi06/tech/full_papers/...
magicalhippo 2y ago
Lua has been used in Linux kernel modules[1][2]. At least for the ZFS case I know they were satisfied with the ability to limit what the Lua scripts could do to avoid issues. [1]: https://lwn.net/Articles/830154/ https://lwn.net/Articles/830154/ [2]: https://openzfs.github.io/openzfs-docs/man/master/8/zfs-program.8.html https://openzfs.github.io/openzfs-docs/man/master/8/zfs-prog...

from what I understand, CrowdStrike has essentially put a Turing-complete interpreter for their scripting language into the kernel. I doubt you can do much when something is that general purpose.

capitainenemo 2y ago

Do you have more information on that? Hadn't read anything about the CS kernel module running arbitrary code. Was it a factor in the crash? 'course, Microsoft also put turing complete scripting in ring 0 years ago for performance reasons (TTFs - XML/HTML parsing and GUI rendering too - to beat other OSes apparently) and that certainly did lead to exploited vulnerabilities... https://googleprojectzero.blogspot.com/2016/07/a-year-of-windows-kernel-font-fuzzing-2.html https://googleprojectzero.blogspot.com/2016/07/a-year-of-win... https://gist.github.com/Nevor/ed3719dad0cf66893e42a9ba024c9174 https://gist.github.com/Nevor/ed3719dad0cf66893e42a9ba024c91... https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-040 https://learn.microsoft.com/en-us/security-updates/securityb... https://www.fortinet.com/blog/threat-research/one-bit-to-rule-them-all-bypassing-windows-10-protections-using-a-single-bit https://www.fortinet.com/blog/threat-research/one-bit-to-rul... https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2011/2639658?redirectedfrom=MSDN https://learn.microsoft.com/en-us/security-updates/SecurityA... https://news.ycombinator.com/item?id=9769099 https://news.ycombinator.com/item?id=9769099 (this comment in particular https://news.ycombinator.com/item?id=9783863 https://news.ycombinator.com/item?id=9783863)

jacobgorm 2y ago

It doesn’t matter if you are doing full Fault Isolation with XFI. I recommend reading the paper here https://www.usenix.org/legacy/event/osdi06/tech/full_papers/erlingsson/erlingsson.pdf https://www.usenix.org/legacy/event/osdi06/tech/full_papers/...

magicalhippo 2y ago

Lua has been used in Linux kernel modules[1][2]. At least for the ZFS case I know they were satisfied with the ability to limit what the Lua scripts could do to avoid issues. [1]: https://lwn.net/Articles/830154/ https://lwn.net/Articles/830154/ [2]: https://openzfs.github.io/openzfs-docs/man/master/8/zfs-program.8.html https://openzfs.github.io/openzfs-docs/man/master/8/zfs-prog...