Post B5nhh7rVT2Cr10JMPI by q3k@social.hackerspace.pl
 (DIR) More posts by q3k@social.hackerspace.pl
 (DIR) Post #B5ncbtzD87fMlHbY1o by q3k@social.hackerspace.pl
       2 likes, 3 repeats
       
       Quickly dove into the copy.fail exploit.1. Yes, it's real.2. Current chain can write any arbitrary content to any user-readable file (into the page cache).3. Current chain relies on an available target suid binary that you can open() as a lowpriv user.4. Current exploit relies on that binary being /bin/su and then being able to execve(/bin/sh, 0, 0) (which doesn't work on alpine, etc.). The former is easily replaced in the code. The latter needs a rebuilt payload ELF (also easy).
       
 (DIR) Post #B5ncbvVVTX5tTjir0S by q3k@social.hackerspace.pl
       1 likes, 1 repeats
       
       5. The authors say they have other chains (including ones that allow container escapes). I believe them.6. A mildly de-minified PoC for Alpine with a new payload ELF is at hackerspace[pl]/~q3k/alpine.py . You'll need /bin/ping from iputils.
       
 (DIR) Post #B5ndA3Xo6GDyFd4ZMm by wolf480pl@mstdn.io
       0 likes, 0 repeats
       
       @q3k would this primitive also work for overwriting code of an already-running privileged process?
       
 (DIR) Post #B5nhh7rVT2Cr10JMPI by q3k@social.hackerspace.pl
       0 likes, 0 repeats
       
       @wolf480pl Yes.
       
 (DIR) Post #B5nhjLbJMFFUCjnNK4 by implr@social.hackerspace.pl
       0 likes, 0 repeats
       
       @wolf480pl @q3k If you managed to get the page swapped out first (with an oom condition or sth), then probably yes, but idk how the page cache interacts with .text mappings to be sure.If that is possible, then there should be plenty of tasty targets in pid1 - systemd is a pretty thicc binary
       
 (DIR) Post #B5nkMVrNLeqhDz72oa by q3k@social.hackerspace.pl
       0 likes, 0 repeats
       
       @implr @wolf480pl You can just write to any running process' .text if you have access to the binary.You should just be able to write a better implementation of close() into /lib/libc.so.6 - one that also drops you a +s, no questions asked su in /tmp before actually closing the file, and wait until a privileged process bites.
       
 (DIR) Post #B5nkMW9oF7au99jlY0 by wolf480pl@mstdn.io
       0 likes, 0 repeats
       
       @q3k@implr people have done that with dirtypipe before https://github.com/polygraphene/DirtyPipe-Android/blob/master/TECHNICAL-DETAILS.md
       
 (DIR) Post #B5nlA2sdMtadpCJudc by astraleureka@social.treehouse.systems
       0 likes, 0 repeats
       
       @q3k working around the broken execve is trivial enough like you said; https://social.treehouse.systems/@astraleureka/116490148181953204it's pretty amusing seeing the trodden pagecache results persist afterwardsRT: https://social.treehouse.systems/users/astraleureka/statuses/116490148181953204