4 ms·
setuid binaries are not the only way to get root. E.g. one can change /etc/crontab or /etc/passwd. Or add trojan to /bin/ls and wait until admin type 'ls'
by delamon 5mo ago
setuid binaries are not the only way to get root. E.g. one can change /etc/crontab or /etc/passwd. Or add trojan to /bin/ls and wait until admin type 'ls'
- quantummagic 5mo agoIt's not always as easy as you imply. All the attack vectors you mentioned, require root on the host, before you can make the change or install the trojan.
- delamon 5mo agoThe attack gives you ability to overwrite any cached page. So you don't need to be root to "edit" /etc/passwd.
- quantummagic 5mo agoNot of the host system, assuming we're talking about a compromised VM, running as a non-root user.
- delamon 5mo agoI assume you mean container, not VM. But yes, container makes it harder.
- minimaltom 5mo agoWorth adding also that you can only use these vectors to corrupt the page cache for files reachable in your mount namespace. Usually with containers, almost nothing is shared with the host namespaces (tho likely shared with other container namespaces, hopefully none of those are --priv).