Hacker News new | ask | show | jobs
by password4321 18 days ago
Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.
5 comments

Not really. Generally we use "Local Privilege Exploit" to describe an exploit that goes from a reasonably normal user privileges to root privileges.

And we don't usually worry about them, because an application with normal user privileges can already to so much damage.

But this exploit can be triggered from inside a tightly sandboxed process, such as firefox's isolated browser process. Which means the attacker now only needs to chain two exploits together: One javascript exploit to get local code execution in an isolated sandbox, and this one to jump all the rest of the way to kernel mode.

Which means, you should update both firefox, and your linux kernel.

> this exploit can be triggered from inside a tightly sandboxed process

Thank you for emphasizing this important detail.

> you should update both firefox, and your linux kernel

No doubt, update all the things! My point was, it can most likely wait until Monday.

Realistically, if you have a browser sandbox, the system LPE exploit gives you very little more. Everything interesting on a desktop system is accessible by the user account directly.
This gets you code execution in the kernel, at which point sandboxing is irrelevant.
Since this enables container escape, sounds like this might still impact quite a lot of us?
I guess, if you thought Docker/etc. was a security boundary
They are a security boundary. The fact that you need a vulnerability to escape them is proof of that. They just don't have a particularly high cost of escape because reachable kernel vulnerabilities are so common.
Some people clearly do use containers as deployment mechanism, with security not in mind.
s/some/most/

That's not meant to be snide, just true, I think.

I never understood why kubernetes doesn't use a VM-per-pod model by default.
Escape from docker containers is trivially easy, if you are able to run as the root user in the container itself.

Many (maybe most) containers actually default to running programs as root. Kernel exploit not required.

If you are given a shell with `docker run -it --rm alpine:3 sh`, can you read the /etc/shadow on the host without kernel exploit? Assuming the docker and kernel are sufficiently update-to-date (e.g. latest Docker on Debian Stable).
No.

The "root" you get in docker is not actually root outside of the namespace the container in running in.

Assuming no bugs in the kernel, it should not be able to do anything more than the UID that it's mapped from.

I don't think this would change anything even if it were true, which it is not. Running as root in a container opens up tons of footguns but it is not a path out of the container on its own.
> They are a security boundary

My mistake, leaving out some adjective one could interpret as a misunderstanding of containers as an effective (etc.) security boundary. Fool me 100+ times and all that.

There must be at least a triple-digit number of CVEs by now demonstratimg that in practice containers are a thinner layer of security (perhaps not quite as thin as the classic recommendation of running SSH on a nonstandard port, but that might be leaning toward the safer side of analogies vs. malicious code!) rather than a boundary like virtualization (not perfect but a best practice for isolation).

Runpod, digital ocean's gpu cloud, and at least a few others use Linux containers for isolation between tenants (look at Wiz's blog post about the nvidia container toolkit bug; digitalocean just puts everyone in a massive k8s cluster)
Why aren’t they using a fast VM like Firecracker?
To squeeze out 5% more profit.
There was a virtual machine KVM escape found like 2 weeks ago.

Nothing is a security boundary anymore.

I know there's a lot you can do in k8s to mitigate it, but I didn't think that prevented it outright.
A lot of us rely on Linux containers' being escape-proof?

I would have hoped that only a few of us are so misinformed as to do that.

If you run critical containers under Linux instead of a dedicated hypervisor, you deserve to get hacked.
Got me confused for a sec, as the exploit in the top comment implies JavaScript→root, but it actually relies on two separate exploits.
they also found a type confusion in firefox/ionmonkey, so you can go from random website to pwned very quickly.
as if in these times there aren't hundreds of "0days" in everyone's hands waiting to be burned for situations just like this.

from ssh to node, so much stuff showing every other week. might as well call everything remote unless you run 100% behind wireguard or something.

Pretty much, the rate at which quality exploits are dropping is mind blowing.