Post B5o8pPYOGtL2xpXrMG by rootwyrm@weird.autos
 (DIR) More posts by rootwyrm@weird.autos
 (DIR) Post #B5nZuOkxAOfzXk41VQ by astraleureka@social.treehouse.systems
       0 likes, 0 repeats
       
       copyfail does work on alpine if you happen to have a readable setuid bin installed - the only setuid bins in a stock install are unreadable. the bundled setuid/execve-su wrapper is broken with busybox, but swapping it out for something that sets argv properly does yield a root shell:% python copyfail-alpine# iduid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)I used /bin/ping (iputils-ping) in this particular case
       
 (DIR) Post #B5o8pPKZ6IHOGx4ooC by rootwyrm@weird.autos
       0 likes, 0 repeats
       
       @astraleureka @cR0w I would expect iputils to work because it's suid AND kernel linked with lazy symbol resolution. Pam should also be a problem. But both are very non-default.
       
 (DIR) Post #B5o8pPYOGtL2xpXrMG by rootwyrm@weird.autos
       0 likes, 0 repeats
       
       @astraleureka @cR0w okiedokie, I wrote up a whole thing on IFIN. But the "nice" version is 6 hours of me screaming at people about basic fucking bounds checking and not having stupid fucking feature flags.The short version is that the stupid fucks who can't do memory management keep fucking doing stupid shit with the page cache, tacked on a new special type of page for the crypto API, and fucked *THAT* up. So as long as the crypto API doesn't get called, you're cool.
       
 (DIR) Post #B5o8pPmZQAgHfoBBSa by rootwyrm@weird.autos
       0 likes, 0 repeats
       
       @astraleureka @cR0w BASICALLY, once again, these dense motherfuckers figured checking was totally optional in C memory management tasks. <scream 1>But because they don't want to do memory management correctly, they shoved in these special scatterlists with STUPID flags for crypto API! <scream 2>So that now userland could create it's own special memory pages in these special SGLs. SGLs which made a whole bunch of VERY bad and VERY stupid assumptions! <scream 3>
       
 (DIR) Post #B5o8pQ0OaljwMgeE0e by rootwyrm@weird.autos
       0 likes, 0 repeats
       
       @astraleureka @cR0w when the CORRECT fucking way to do it would be to ISOLATE THE FUCK OUT OF THE PAGES and MAKE GODDAMN SURE THE SOURCE AND DESTINATION WENT TOGETHER and NOT LET USERLAND SPLICE SHIT INTO ANY RANDOM PAGE and MAKE DAMN SURE THINGS LINED UP. <screams 4-65534>
       
 (DIR) Post #B5o8pQCRrxNgy4HqnQ by equinox@chaos.social
       0 likes, 0 repeats
       
       @rootwyrm @astraleureka @cR0w calling this a "memory management" issue is quite a stretch. It has nothing to do with memory allocation or even bounds checking directly. The authencesn code is *intentionally* writing "out of bounds". If they added bounds checking, they probably would've copied the mistaken assumptions into the bounds check.This is really them outsmarting themselves with zerocopy I/O. [1/2]
       
 (DIR) Post #B5o8pQS2vxrFkRaJ6m by equinox@chaos.social
       0 likes, 0 repeats
       
       @rootwyrm @astraleureka @cR0w it's a really poor choice of scratch space, ultimately.Honestly, this might even have happened with Rust. The page cache at large isn't something Rust could reason about, and the input and output for the kernel function is technically outside the kernel on this, ergo behind the syscall boundary. The validity checks are in the AEAD code, but authencesn uses different boundaries. Maybe that's where it could be caught; encoding the AEAD contract into types.
       
 (DIR) Post #B5o8pQhzyecOXv32yO by rootwyrm@weird.autos
       0 likes, 0 repeats
       
       @equinox @astraleureka @cR0w except this is a deliberate, intentional, long-term smearing of things in the fundamental memory management design. There is only 'page buffers' which could be disk! Could be sensitive! Could be mkstmp()! Could be fucking ANYTHING.This is not just utterly stupid, it is brain damaged, dangerous, and insecure. Today it's making bad assumptions and failing basic sanity checks. Tomorrow it could be walking another user's disk reads with SLGs. (Probably will be.)
       
 (DIR) Post #B5o8pQz0xOEHOh0dUm by equinox@chaos.social
       0 likes, 1 repeats
       
       @rootwyrm @astraleureka @cR0w I mean, yeah. It's all just to copy fewer bytes around. splice() wouldn't exist without people trying to get zerocopy.That said, this shit has probably also saved a measurable amount of CO2…
       
 (DIR) Post #B5o8pRSRBzlUrwm8MC by rootwyrm@weird.autos
       0 likes, 0 repeats
       
       @equinox @astraleureka @cR0w one of the things I have hammered home time and time and time again for years and years is that C will murder people who do not plan or think beyond the function, and doubly so in memory.Defects like this are not accidents. They are a lack of planning and forethought come home to roost. As soon as I saw one *part* of the patch I knew the problem. It's that bad. And it's not because desperately trying to do zerocopy the lazy way. It was just not fucking *thinking*.