6 ms·
Linux Kernel Exploitation: Attack of the Vsock
- klysm 2y ago> So I set off on a journey that would lower my GPA and occasionally leave me questioning my sanity Amazing! Sacrificing GPA for projects is always a good time
- dudus 2y agoAs a teacher once told me. "Never let school limit your education"
- technothrasher 2y agoI learned a ton while at my university. Much of it was outside of my classwork.
- nzeid 2y agoFor those wondering this is a common paraphrase of Grant Allen and Mark Twain. Here we say "Never let school get in the way of a good education."
- anyfoo 2y agoI really liked the old German university concept, the one before we just took over Bachelor/Master. Throughout my CS studies, I was just collecting "tickets" (very hard to translate the actual word, "Schein"), which basically just attested that you have passed a course. They (often) had a grade on it, but it did not matter. Instead, once in the middle ("pre-diploma") and once at the very end of your time at university, you'd have oral exams. And those determined your grade. To attend them, you needed the right combination of "tickets". The glaring downside of this system is that if you had a bad time in those few months of your very final exams, you could screw up your entire grade. The upside of it, is that I was free (and encouraged) to pursue whatever I wanted, without each course risking to have an effect on my "GPA". I had way more tickets than I needed in the end, and still time and energy to pursue whatever else I wanted (playing with microcontrollers etc.).
- klysm 2y agoI had a couple of classes in USA uni that worked quite similarly. The professor said we can take the quizzes if we want, and if we didn't then the later quizzes would constitute more of your grade. The ultimate play was to only take the final quiz.
- cherryteastain 2y ago> The ultimate play was to only take the final quiz. This is how a lot of British undergrad courses ('modules') work. One giant exam at the very end determining everything; no quizzes, no problem sheets, no midterms.
- xen2xen1 2y agoWould not be a surprise if AI brought this back.
- eru 2y ago> Throughout my CS studies, I was just collecting "tickets" (very hard to translate the actual word, "Schein"), which basically just attested that you have passed a course. They (often) had a grade on it, but it did not matter. Instead, once in the middle ("pre-diploma") and once at the very end of your time at university, you'd have oral exams. And those determined your grade. To attend them, you needed the right combination of "tickets". What you are describing was one of the systems they used. So at my university (OvG in Magdeburg) they used this system for math, but computer science had written exams.
- deleted 2y ago[deleted]
- cperciva 2y agoAgreed. My GPA suffered significantly in 1999 when I was writing a web service to help me calculate Pi, but it was absolutely worth it.
- deleted 2y ago[deleted]
- Dwedit 2y agoYay Rop Chains!
- xyst 2y agoyet another "use-after-free" sploit Rust for Linux, wen? It's a damn shame the current maintainers are so hostile to its adoption that many of the original rust 4 linux folks have left the project.
- doug713705 2y agoDid they start their own project ? Linux is free, just fork it.
- klysm 2y agoThe 'just' doesn't belong in front of 'fork'.
- surajrmal 2y agoThere are a lot of entities involved that need to be able to work together. Creating a form fractures things and requires all partners to move to said fork. It's far easier to work upstream even with resistance. Anyone who has maintained a long standing Linux fork understands the costs of trying to rebase thousands of patches. There will never be enough of a migration to make it unnecessary to need to rebase.
- riehwvfbk 2y ago"Hey upstream maintainer, let me commit a bunch of code in a language you can't even read. You get to maintain it forever while I get to move on to bigger and better things. I am better that you after all: I know this cool new language and you don't." And this didn't go over well. Shocking.
- seanhunter 2y agoThat isn't a remotely fair characterization of what the rust for linux team were saying. In particular they committed to maintaining it. https://lwn.net/Articles/1006805/ https://lwn.net/Articles/1006805/ "We wrote a single piece of Rust code that abstracts the C API for all Rust drivers, which we offer to maintain ourselves". I wish that HN as a whole could maintain a respectful and curious tone of debate when these threads come up. Feel like both rust advocates and skeptics could do a lot better.
- chc4 2y agoGoing for the pipe spray is a kinda weird technique, and I'm honestly surprised that it worked. Usually just the fact that you are able to spray over the allocation at all isn't enough, and you also have to worry about your sprayed data containing additional pointers or things that also have to be valid. I probably would have gone for turning the UaF into an type confusion style attack: if you spray more sockets you'll end up with two files, the original and the new one, that have aliased sk members, but the vsock code will incorrectly cast the new one to a `vsock_sock`. From there you can probably find some other socket type that puts controllable data over some field that vsock treats as a pointer or vice versa, and use it as both a kaslr leak and data-only r/w primitive.
- benwilber0 2y ago> I probably would have gone for turning the UaF into an type confusion style attack I'm aware that Linux is nearly 40 years old at this point, and C is even decades older. But it is mind-boggling to me that we're still talking about UAFs and jumping from dangling pointers to get privileged executions in the 21st century. (rewrite it in Rust)
- deleted 2y ago[deleted]
- Ygg2 2y agoNonsense, the C guy told me those happen to people that make mistakes, and that he, being the offspring of the Elemental of Logic, and "Hyperspace cybernetic intelligence and juvenile delinquent John Carmack" is completely immune to such pathetic issues. He works at Linux. Yes, all of Linux.
- uecker 2y agoYes, we need a languages that makes it impossible. But how could this happen in Rust? https://github.com/advisories/GHSA-5gmm-6m36-r7jh https://github.com/advisories/GHSA-5gmm-6m36-r7jh But clearly, this does not count because it used "unsafe", so it remains the programmer's fault who made a mistake. Oh wait, doesn't this invalidate your argument?
- mperham 2y ago"We’ve Got a Panic!" Looks like we've got an encoding issue too.
- bombcar 2y agoI kind of want to trademark †so that ’ is not just mojibake.
- jdironman 2y agoNot sure Musk would let you trademark his kids name. /s
- klysm 2y agoI thought this was a joke at corrupting the data intentionally
- nyanpasu64 2y agoI'm confused. The page has a HTML5 doctype, and https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta#attributes https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... says that UTF-8 is the only valid encoding for HTML5 documents, yet Firefox interprets the page as Windows-1252 or such until I "Repair Text Encoding". https://webhint.io/docs/user-guide/hints/hint-meta-charset-utf-8/ https://webhint.io/docs/user-guide/hints/hint-meta-charset-u... says you're supposed to include a <meta charset="utf-8"> or optionally Content-Type header.
- shakna 2y agoIf you don't have a charset set, then you'll get the fallback for IE compatibility. You should pretty much always use one.
- aaronmdjones 2y agoThe server is responding with Content-Type: text/html i.e. no charset field. The document itself also lacks a declared character set.
- dang 2y ago[stub for offtopicness]
- cyberpunk 2y agoCool writeup, and you have exceptional taste in fonts.
- ohc 2y agoI can't read the dark blue links on the black background
- gerdesj 2y agoEngage reading mode and relax.
- Ylpertnodi 2y agoVictim blaming.
- inquirerGeneral 2y ago[dead]
- yapyap 2y agoThe dark blue on black reads absolutely terribly
- neuronflux 2y agoTry the Reader View feature of Firefox.
- las_balas_tres 2y agoFor the love of god please change the blue on black text to something more readable
- deleted 2y ago[deleted]
- waltercool 2y ago[dead]
- snvzz 2y agoThe Linux Kernel has millions of LoCs. There'll always be bugs. It's about time to look at a sane design, such as seL4[0]. https://sel4.systems/About/seL4-whitepaper.pdf https://sel4.systems/About/seL4-whitepaper.pdf
- signa11 2y agodon’t mind if you do guv.
- surajrmal 2y agoIt's becoming more and more common to use non Linux based hypervisors to isolate workloads where security matters. Isolating applications within a given VM is not seen as important and therefore ditching Linux isn't really necessary. Applications can continue to be written against Linux APIs and we can create isolation domains separately. This is no longer just a server concept as even phones and cars are starting to employ this technique. It has high cost to RAM, but as RAM gets cheaper it's not as big of a deal.
- fc417fc802 2y agoThe obvious question is why Linux is so widely used in the first place. I don't think "APIs" is enough to explain it. One obvious answer is the incredibly broad hardware support. Any alternative selected for use as the hypervisor is going to be at a serious disadvantage in that regard.
- surajrmal 2y agoNot necessarily. You can forward a lot of hardware as is to a Linux VM if you have an iommu. It comes down to whether you need multiple VMs to share access to some hardware or not, which is not all that common based on the way the isolation domains work out. This can start to become more challenging when that hardware has shared resources such as clocks, buses, or power rails to manage, but soc makers are likely going to make hardware increasingly easier to work in this modality as customers require it.
- 2y ago
- grg0 2y agoGood write-up. I liked your RSA tutorial too: https://hoefler.dev/content/RSA.pdf https://hoefler.dev/content/RSA.pdf