Post B66hDvwEPcjHdiq8em by ariadne@social.treehouse.systems
(DIR) More posts by ariadne@social.treehouse.systems
(DIR) Post #B664XhVrrGe2TowYDY by ariadne@social.treehouse.systems
2 likes, 0 repeats
the #dirtyfrag exploit does not run successfully on alpine because the path to the donor SUID binary is hardcoded as /usr/bin/su.changing that to /bin/bbsuid allows the exploit to run, but it hangs for me on linux-lts 6.18.27.interestingly, openpax kernels kill the exploit early in the exploit chain.either way, 6.18.28 fixes it for everyone.but it goes to show the danger of #SUID binaries and why SUID-less solutions like #capsudo are important.#alpinelinux
(DIR) Post #B66634JzCtra9MuIue by starchturrets@mastodon.social
0 likes, 0 repeats
@ariadne as I understand it (might be wrong, no researcher) if you can corrupt the page cache for any readable file then suid is a bit orthogonal no? IIRC I saw a poc where just /etc/passwd was corrupted
(DIR) Post #B666DJxHw3bhX9B9pg by ariadne@social.treehouse.systems
0 likes, 0 repeats
@starchturrets alpine does not use /etc/passwd for passwords. only /etc/shadow. so that part of the exploit also fails :)
(DIR) Post #B666SIn8XoTyGgZfUG by lanodan@queer.hacktivis.me
0 likes, 0 repeats
@ariadne @starchturrets Like at all? Because well, you can set the password field to empty instead of x and quite few implementations of su(1) will let you through.In fact I patched shadow-maint to mitigate that years ago: https://github.com/shadow-maint/shadow/pull/315
(DIR) Post #B666bLanV2wrYs7Edk by ariadne@social.treehouse.systems
1 likes, 0 repeats
@lanodan @starchturrets alpine only allows that on /etc/securetty TTYs
(DIR) Post #B667QXVCykPfGfuaae by starchturrets@mastodon.social
0 likes, 0 repeats
@ariadne what if they target that then?
(DIR) Post #B668MTYbnxR7pP81aK by ariadne@social.treehouse.systems
0 likes, 0 repeats
@starchturrets *shrug*
(DIR) Post #B668VdKkpDqkkv0yqe by starchturrets@mastodon.social
0 likes, 0 repeats
@ariadne oh ic. Also I didn't know openpax was from edera, that's cool. Any chance the blog could get an RSS feed? 😅
(DIR) Post #B66A9fPmbgfekQ1JxI by ariadne@social.treehouse.systems
0 likes, 0 repeats
@starchturrets which blog?
(DIR) Post #B66CFbXo6tp8OBjTuq by starchturrets@mastodon.social
0 likes, 0 repeats
@ariadne edera.dev/stories
(DIR) Post #B66CYQbiztMtyHXaXg by ariadne@social.treehouse.systems
0 likes, 0 repeats
@starchturrets i will forward your request along to the website person. it might be possible.
(DIR) Post #B66Fc5H4YSqApRJdPU by ariadne@social.treehouse.systems
0 likes, 0 repeats
@starchturrets our website guy told me to direct you to https://edera.dev/stories/rss.xmla ticket was also created to add an RSS button
(DIR) Post #B66Hpq2sAlOXYjMOZ6 by starchturrets@mastodon.social
0 likes, 0 repeats
@ariadne ty! checked the <head> and also tried /feed.xml and the like but kept 404ing so I assumed there was nothing
(DIR) Post #B66fMio6P2ytc16Hmy by jamesh@aus.social
0 likes, 0 repeats
@ariadne setuid binaries are the simplest exploit vector. But if you can poison the page cache for something a higher privilege user is going to call soon (e.g. a cron job or timer), presumably that could be an exploit vector.
(DIR) Post #B66hDvwEPcjHdiq8em by ariadne@social.treehouse.systems
0 likes, 0 repeats
@jamesh that does not take away from my point that we should be eliminating SUID binaries