eqvinox

12 ms·

331.
by eqvinox 6mo ago
And again it's band-aiding the problem. Can authencesn not be fixed or what?
332.
by eqvinox 6mo ago
Yes, it'd curtail splice() usage quite heavily. Maybe too much. But apparently we can't be trusted with the page cache… Maybe the kernel using supervisor-read-only flags could be made to work, only issue then is what happens if so
333.
by eqvinox 6mo ago
"proper read-write mode" for the input fd is reading only. The exploit is writing to the splice() input fd. Also, NB, I said permission check, not mode check. The input fd to splice can and will be open for only reading quite of
334.
by eqvinox 6mo ago
If you don't need it (rootless containers), you can disable unprivileged userns to block these two: echo 1 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns May also break sandboxes (e.g. brow
335.
by eqvinox 6mo ago
Yes, I agree. I'm not the GP poster.
336.
by eqvinox 6mo ago
I don't think the copy.fail people understood the issue they found, as is evident by the heavy focus on AF_ALG/aead_algif, which is essentially "innocent" as we're seeing here. I think LLMs are great for vulnerabili
337.
by eqvinox 6mo ago
You mixed up the names vs. config options but yes killing those 3 options should make you "safe". No warranty.
338.
by eqvinox 6mo ago
The part where you run everything as root is particularly stupid. But yes, user isolation has been weakened quite a bit.
339.
by eqvinox 6mo ago
splice() should maybe generally refuse to operate on things you can't write to.
340.
by eqvinox 6mo ago
(you probably wrote this while I was editing my post.) It's absolutely the same issue in authencesn/ESP. There's another one in RxRPC that is AIUI completely unrelated.
341.
by eqvinox 6mo ago
No, unless I'm misreading it it's the *same* root cause: high 32 bits of Extended ESN in IPsec == authencesn module/cipher mode. The wrong thing got fixed for copy.fail, because people jumped to blame AF_ALG. [ed.: yes it&#
342.
by eqvinox 6mo ago
Yeah, so, as we just learned (dirty.frag) the issue isn't algif_aead, it's authencesn and you can exploit it through plain network sockets rather than AF_ALG.
343.
by eqvinox 6mo ago
And I ask again: why the f*ck is algif_aead getting all the flak for copy.fail? It's authencesn being stupid. authencesn didn't get fixed. Now we got the results of that, turns out you can access the same (I believe) out of bound
344.
by eqvinox 6mo ago
It's not a cache write primitive though; it's a write-to-readable-mappings primitive. At least the way I understood it is, you need to be able to get a (read) file descriptor to the target in order to throw it into the splice() sy
345.
by eqvinox 6mo ago
A bulldozer is a large and complex physical machine, yet it has (almost¹) no safeguards against misuse or injury. It's all operator training. Lathes tend to not have doors/enclosures, in particular large ones. You get taught where
346.
by eqvinox 6mo ago
> A lot of tools have affordances built in to make "right" things easy and "wrong" or unsafe things harder. This is true for almost anything handed to laypeople, but not for a lot of professional tools. Even a plain
347.
by eqvinox 6mo ago
> if libraries or binaries are shared (read-only) between the host and container. Yeah, exactly - that's a pretty big "if", and not how a lot of container automation does things. In particular you'd need to hit the ba
348.
by eqvinox 6mo ago
AIUI they haven't shown a container escape and are just claiming it so far. Or did I miss something?
349.
by eqvinox 6mo ago
It does feel a little simplistic to get a special name. But lesser things have gotten fancier names...
350.
by eqvinox 6mo ago
Running sstrip on an ELF binary is called ELF "golfing"? TIL…
351.
by eqvinox 6mo ago
JFTR: achieving that capacity retention is a question of charge settings. Pretty much any Lithium ion battery can achieve it if you don't charge it to the absolute maximum possible each time. It's quite simple. While you can c
352.
by eqvinox 6mo ago
That's really orthogonal (and you can already do io_uring with AF_ALG, at the end of the day AF_ALG is just recvmsg() and sendmsg(), which work just fine in io_uring...)
353.
by eqvinox 6mo ago
Cheesecake Now, is your comment contributing more to this discussion, or mine?
354.
by eqvinox 6mo ago
If neither a hardware component nor kernel key management is involved, crypto should be done in userspace, end of sentence. The more I think about it, the more I think it should be behind CAP_SYS_ADMIN, or a new CAP_KCRYPT (better name TBD.
355.
by eqvinox 6mo ago
Yes, AF_ALG is exposing too many things, like authencesn, which has zero reason for being userspace accessible. It's a crypto mode specific to IPsec. However, > it should be accessed from user space by a process with the appropriate
356.
by eqvinox 6mo ago
It is being used that way: https://github.com/opensourcerouting/frr/blob/2b48e4f97fb021... And, sure, if it breaks system security it's pointless. But so did "dirty pipe". I do agree the number
357.
by eqvinox 6mo ago
You can't access TPMs that way.
358.
by eqvinox 6mo ago
The primary benefit of AF_ALG is IMHO when it's combined with kernel keyrings, i.e. ALG_SET_KEY_BY_KEY_SERIAL. To steal from the sibling post: > * When using user space libraries, all key material and other cryptographic sensitive p
359.
by eqvinox 6mo ago
Reminds me of the Interrail data breach [ https://stateofsurveillance.org/news/eurail-data-breach-3080... ] The fediverse take on that was "customers are advised to rotate their faces and birthdays."
360.
by eqvinox 6mo ago
I was implying all 3 of the above: - we learned the hard way that data will be used to kill people, during the Nazi regime - we learned it again in the GDR with the Stasi being a little less obvious but still ruining people's livelihoo

More ›