new linux exploit is absolutely insane

The new privilege escalation against the Linux is absolutely wild. In this video we talk about what a privesc is, how they typically work, and why the techniques used in this one are so wild
Writeup: pwning.tech/nftables/
PoC: github.com/Notselwyn/CVE-2024...
Author: / notselwyn
🏫 COURSES 🏫 Learn to code in C at lowlevel.academy
📰 NEWSLETTER 📰 Sign up for our newsletter at mailchi.mp/lowlevel/the-low-down
🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒
Blue Fox: Arm Assembly Internals and Reverse Engineering: amzn.to/4394t87
Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation : amzn.to/3C1z4sk
Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software : amzn.to/3C1daFy
The Ghidra Book: The Definitive Guide: amzn.to/3WC2Vkg
🔥🔥🔥 SOCIALS 🔥🔥🔥
Low Level Merch!: lowlevel.store/
Follow me on Twitter: / lowleveltweets
Follow me on Twitch: / lowlevellearning
Join me on Discord!: / discord

[@LowLevelLearning]

Thanks for watching guys! ( come learn C at lowlevel.academy 🥺)

[@Daniel-vs7it]

hi

[@Alfred-Neuman]

Ha! I always knew Linux was unsafe! That's why I'm still using Windows 98 and I only connect to the internet with my 56k modem...

[@drpoundsign]

@@Alfred-Neuman LUV that toilet-flushing sound. I DO hope you are being Facetious and Sarcastic.

[@real_yoplayer1]

​No, @@drpoundsign, Windows 98 is the newest version of Windows, safe and secure

[@ChuckNorris-lf6vo]

OK but I need to debloat my android phones can I use this to root and debloat ?

[@PS_Tube]

It was discovered in January, 2024. And has been patched already. All the rolling distributions would have the patch already installed. Ubuntu has already issued the patch back in Jan.

[@rbgtk]

Thanks!

[@maxturgeon89]

Thanks! That definitely should have been part of the video

[@sunilpaul6891]

I got really worried because i run linux; thanks

[@zeckma]

Thanks for informing us!

[@TurtleKwitty]

@@sunilpaul6891 A professional researched bug like this is always patched before it becomes public like this, assume its fixed unless it's mentioned it's not

[@Swampdragon102]

The most shocking part of this video was that 2016 was 8 years ago.

[@edwardmacnab354]

I missed the 2016 mentioned , where is it in the video ?

[@NisheshTyagi]

@@edwardmacnab354 2:02

[@maro0ozzz]

@@edwardmacnab354 2:02

[@ryadboufar4741]

sad reacts only

[@jjm7797]

@@edwardmacnab354 2:02, you didn't miss much!

[@WansVids]

If you're wondering which kernel versions are vulnerable, here's what I found: The exploit affects kernel versions from (including) v5.14 to (including) v6.6, excluding patched branches v5.15.149>, v6.1.76>, v6.6.15>.

[@Blaineworld]

i’m on 6.8.0 so that means i’m safe? right?

[@WansVids]

@@BlaineworldYeah, you're fine. It's patched since 6.7.

[@rayauxey]

I'm surprised he didn't include this in the video

[@guilherme5094]

o7!

[@Tobsson]

​@ap3ture0switch distro to fedora or arch. You'll always be up to speed.

[@XerrolAvengerII]

me, a plucky wizards apprentice resetting user passwords and setting up accounts, watching a KZbin video about dark sorcerers unraveling death itself and warping space and time

[@LowLevelLearning]

I love this analogy XD

[@Dirtyharry70585]

Simply about money and or destruction of property by people who have no morals, and could care less about who it affects or lives that can be lost

[@slayeryt637]

@@Dirtyharry70585 there's so many more reasons to want to make exploits than just death and destruction. What about the pure beauty in the exploit itself?

[@52665736]

my name is my passport, then only i can be i as good as i... especialy in tron trades of wireless energetic multi androidic communication, were the cyberwar algorithm makes attack due ineffecientcy by having a password different then own name.... entering string linguistic and design of solid state reality... and so on and so forth.... = no pwd, then it is my own PersonalComputer communication fassett!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[@stopcensoringmen5044]

What I like about Linux is that when a vulnerability like this is found, the community comes together and fixes it asap.

[@akulkis]

In contrast to Microsoft, who hides security bug reports while working feverishly to replace the functionality of the discovered back door by writing a patch which closes the discovered back door with a new back door. Only then does Microsoft admit that the security issue even exists.

[@poisonouspotato1]

the sun never sets on the global open source community

[@BakelitTV]

yes! unlike Windows or other communities where they don't fix vulnerabilities asap. (???)

[@Z3rgatul]

linux community has no way to hide vulnerability fix, since fix goes open source. unlike with close source you can make a fix, and hackers will not know what was fixed and they can't exploit vulnerability on unpatched systems. i am not defending close source, I am just saying there is pros and cons everywhere

[@Moe_Posting_Chad]

So how long was the vulnerability sold and exploited before it leaked? *That's the real question.*

[@jimdiroffii]

I just read this entire write up yesterday, and I was blown away with the thoroughness and complexity of the research. And, it was only found because the author found a bug while trying to do some work. Most people just find another way, this guy found a wild exploit. Very impressive. Cheers to notselwyn

[@demonman1234]

We’re making it out of the userspace with this one boys

[@pu239]

Hi, this was a slightly unleveled video: It was basic in the beginning with you explaining what the kernel does and about syscalls, and then you explained the whole exploit in less time than that, which was too advanced. I know what the kernel is and that by interfacing with the kernel you are asking the kernel to do stuff. I also understand double-freeing and use after free, but socket buffer freelist/all those page descriptors/modprobe was explained in less than 2 minutes If you spent maybe 2 mins explaining the kernel and syscall basics part and 4-5 mins on the actual exploit, it would have more sense Thanks!

[@adammontgomery7980]

Nah, this deserves an hour at least.

[@a.lollipop]

i agree, i got very lost when he was explaining the actual exploit haha

[@WasguckstdudieURlan]

Maybe he did it by intention, it's quite new after all. However he linked the full article in the description (77 min read) that goes into full detail

[@aaaAaAAaaaaAa1aAAAAaaaaAAAAaaa]

its mostly just data structure manipulation

[@patrickstival6179]

Yeah, I got that same feeling. I will ask chatgpt now about that stuff

[@incogninto1124]

Time to finally root the Oculus Quest 2

[@hyperkiko]

it has already been done anyways

[@incogninto1124]

@@hyperkiko Why not do it again?

[@n0tjak]

​@@incogninto1124sure

[@hyperkiko]

@@incogninto1124 i will actually try it on my quest 3, i checked the kernel for the quest 3 and it isnt patched on it

[@wheeI]

looking for a poc right now

[@kayakMike1000]

Running in kernel is worse than running as root.

[@dahahaka]

from my understanding they're not really running or changing that much code inside the kernel, that might be pretty complicated, but they're letting the kernel execute their binary as root by changing a path, that's still not running inside the kernel

[@rusi6219]

Everything should run in kernel This comment was posted by TempleOS Gang

[@kayakMike1000]

@@dahahaka well, depends. Running inside the kernel could cause a kernel panic and crash the whole system, running as root just causes a segfault

[@dahahaka]

@@rusi6219 niche and I love it

[@averagegeek3957]

@@rusi6219 RIP Terry

[@clintonreisig]

It was fixed almost immediately. That is a strong advantage of Open Source in contrast to big corp coverups

[@GoogleDoesEvil]

If it was Windows, it would have been fixed before it was disclosed.

[@kooostia16]

@@GoogleDoesEvil it would be fixed after it was disclosed after several years

[@YTDeletes90PercentOfMyComments]

@@kooostia16 it would then take 30 years for corporations to implement the fix

[@dusxmt]

A disadvantage is that a whole bunch of companies "just ship" open source solutions based off of Linux and barely provide any security updates, which are critically important. This is one of the reasons I don't like IoT, because it's extremely susceptible to issues like this.

[@edwardmacnab354]

@@GoogleDoesEvil it would have been fixed ? by windows ? , tell me you don't know the history of windows by not telling me --lol

[@RobertHyrkiel]

I'm learning that the safest way to store your secure data is on a piece of paper

[@Gogeta70]

Yep, no better method than writing your password on a sticky note and "hiding" it under your keyboard... lol

[@YeeLeeHaw]

Only second to your brain, but sometimes the files can get corrupted up there or with package loss before reaching your fingers.

[@Sypaka]

And all it takes, is a pencil to make a copy of everything you wrote.

[@oxylepy2]

@@Sypaka assuming the location of the written information is known. Sure it isn't going to stop your kids from finding it, or Boeing, but it works against the hackers online

[@someoneelse5005]

@@Sypakaor a photo but you keep forgetting the whole part of physically being there

[@thedtubeteam7981]

Welp, time to upgrade my kernel.

[@kolz4ever1980]

you think? Might be why distros push out updates..

[@ent2220]

Tell me about it. I'm still on Fedora 37 with kernel 5.15 LTS, which I haven't updated in about 6 months because the updates stopped lmao. I might have to jump to the newest Fedora 40 beta.Luckily 99% of my apps are flatpaked, installed with the --user flag, and I have dconf commands to apply all my GNOME settings. So I would barely have to re-setup anything and will have all my apps and userdata once I upgrade.

[@robertjenkins6132]

What's the big deal? As I understand, malicious code running in userland could take advantage of the exploit to run arbitrary code as root? But why would you run malicious code on your computer??? My personal policy is that I don't run anything that I'm not getting from a trusted source. You have javascript on web pages but that runs in its own sandbox in the browser (on Windows as well), and if you have AdBlock installed then that blocks a lot of crud right there. The Internet is more centralized nowadays so most people spend their time on a few websites run by giant corporations. Presumably your personal network is protected with a wifi password and firewall. I mean, if you're a network admin and people can come in and run any kind of code on your network's computers, then maybe that's where it would be warranted to be a bit concerned about such a privilege escalation vulnerability. In olden days everything ran as root in Windows 3.1 (or the Windows analogue of "root"), but you would not become infected if you did not click on malicious .exe files (also best to avoid Internet Explorer and ActiveX). I think that if there is malicious code, which might be inclined to _attempt_ a privlege escalation exploit, running on your machine, then you're already in a bad place. In my opinion, it's not good to have malicious code running, even if it is not escalated up to root...

[@Catalyst8487]

Really enjoyed this kind of video from you! Admittedly, some of the exploit explanation went over my head and I'll need to do some further research on my end. You might have yourself a little niche here of in-depth explanations of vulnerabilities in an ELI5 manner if you want it. I'd love to see more videos like this with other well-known or new vulnerabilities.

[@hawkbirdtree3660]

Bugs never went away, but recently, it feels like bugs just did 20 years in prison, and they've been released on parole.

[@petermathijssen9470]

Great that you used one of the Tuxlets in your video, that I made with my son years ago. 👍

[@BenjaminVestergaard]

The poor guy that was tasked to educate me about Linux wasn't allowed to use an updated Linux for education... he had to stick to one (old) version of RedHat, because that's what the book used... It took me 1 Google, 3 potential exploits and 15 minutes to become root of that educational Linux server. (Okay, I was familiar with Linux before they tried to educate me). I just made an extra root account, which was allowed to login via ssh. Could have locked out everyone else... but I was just making a point about using outdated software for education. Netfilter is quite a problem if it can elevate privileges. But at the same time kinda predictable... I'm happy that it's been found, so next iteration will be safer. Worst is how easy it can be used.

[@user-ym4xy6us5e]

Excellent whitehat hacking.

[@IngwiePhoenix]

I am looking at the proprietary Linux devices at home and at work and just... curiously tapping my chin. This ought to be interesting (:

[@TalsBadKidney]

okay the GH says this blows right through defaults on debian-core systems... does this work on more serious SELinux like RHEL or Gentoo?

[@oscarmendez9079]

Relatively new here - background is in mechanical engineering but I would really like to learn embedded software development ( for myself and for my job). Really enjoy these types of videos. I will say I always write some of the acronyms from these videos down on stickies to look up later, given my lack of knowledge of the inner workings of computers. TIL what a TLB is. Anyways, looking forward to any and all videos 👍🏼

[@edk3539]

translate look-aside buffer. i learned it in early ee/cs course on cpu's

[@arthurmoore9488]

Analogy, you know how you can have a reference book which has a chapter list at the front, then every chapter has a section list at the start. That's how these work. Another common trick is to say: * Chapter 1 - Pages 100-199 * Chapter 2 - Pages 200-299 etc... Sure there may be some blank pages, but the hardware can be designed to be really really fast.

[@AadidevSooknananNXS]

Hey @LowLevelLearning, how do you decide what to learn?

[@claudiu7909]

Hmmm, what I hear is: NEW android rooting method (possibly) if someone implements this functionality into a su/sudo, someone else might be able to port it on android and we'll have a new way of rooting some of the older phones that either didn't have a way to be rooted or didn't have a big enough user base for someone to find a way to root them. ofc this is only possible if the same exploit is available in the android kernel.

[@morgwai667]

the amount of grinding through kernel code and memory dumps that must have been put to develop this exploit is beyond my comprehension... now if i add to this that merely obtaining a kernel memory dump is way more complicated than in case of a user space results in me getting a headache just thinking about it ;-]

[@nunyobiznez875]

This works a bit like a digital Rube Goldberg machine.

[@dustsheep1316]

I love how you keep it short all the time, I don't want to watch through 40 minutes of detailed explanation. This is the perfect overview - thank you very much

[@AWIRE_onpc]

Right after i installed debian...

[@vaisakhkm783]

XD good luck for next 10 years...

[@yramagicman675]

@@vaisakhkm783 eh, if I'm not trying yo completely kill the joke it's more like 3 months. Debian does apply security patches pretty effectively. To kill the joke completely, in reality, the bug is probably patched in latest and LTS kernels by now, it's just up to the distributions at this point, and Debian uses a patched version of the LTS kernel

[@Excalibur13]

rm -rf install gentoo

[@Jeppelelle]

So? Just update the kernel like you would on any other distro

[@darthrevan501st]

@@Excalibur13 rm -rf --no-preserve-root

[@enigmatico6209]

Yeah all Linux distributions probably has this patched, but think about all the routers and phones and devices like smart TVs and everything that are connected to the internet and are probably still outdated, like your router if you have an ISP that doesn't allow you to switch it. A lot of these run on Linux and are likely using an outdated version of the kernel.

[@techwolflupindo]

And to think, one can now hack it to put there own updated software that the manufacture locks you out of so you can't update.

[@user-ym4xy6us5e]

@@techwolflupindoTheir?

[@xeqqail3546]

Really hope one day I could comprehend all this shenanigans lol .. great vid!

[@sumless]

One thing many folks might not understand is that the attacker needs to have access to the system to exploit/gain this privilege. That being said, it can be used in a process where user xyz is harmlessly (or intentionally) installing something onto the box itself. This doesn't mean that any Linux system sitting idly on a network can be exploited from a pure network means. One of the overcites most folks make is hearing there is an exploit that gains root access means you need to drop everything and patch any and every system running Linux distro version xyz as the exploit affects them immediately. It really depends on the system, it's use, it's broad access, and several other factors. Granted, this is not to say you should not address such a situation, but by all means it doesn't mean the sky is falling either. All the same, very interesting how this one works, and thank you for breaking it down the way you have.

[@b00gi3]

This channel is so awesome and educational. Look forward to spending more time with it.

[@UltimatePerfection]

Can you talk about the backdoor in liblzma/xz that lets you avoid SSH?

[@softwarelivre2389]

He just did! The man is really quick

[@haywardgg]

Should have pointed out that so long as people were doing their updates, this was patched back in January. FUD, for clickbait!

[@woahblow4127]

How is double free a thing? Is it for multiple locks on the same file? Lock decrements instead of setting to 0? Are there double lock errors then when files are permanently closed?

[@anthonybernstein1626]

Kinda, but it’s not files, it’s memory: foo = kmalloc(whatever); (lots of other stuff) kfree(foo); (more stuff) kfree(foo); The allocator uses the freed memory to store pointers to other free memory so that it knows what’s free (and not to waste additional memory to store this). You can imagine it as free pieces of memory pointing to other free pieces of memory in a long chain. If you free the same piece the second time, it will be in this chain twice. Now if you allocate a new piece, you could get this twice-freed piece back so you can write data to it - but it’s still in the list (since it was added twice) so whatever you write there, the allocator thinks is part of the free chain - so you can redirect the allocator and force it to write to memory it’s not supposed to.

[@Ilovecruise]

Hmm, self learning cyber security here, so this attack would not work on environments where Structured Exception Handling Overwrite Protection is enabled, because the kernel entry does not match the one as recorded? Or is it not available on Linux? Thanks

[@benjaminshropshire2900]

I wonder if segregating the kernel dynamic memory meta data from the allocate-able memory would make this harder? Use the freed block to hold their own meta data is nice, but is it an unnecessary risk?

[@researcher_x]

Thanks for sharing your enthusiasm on this exploit. Next time, please try digging into it.

[@raelimec]

I dont understand almost any of these but still catches my genuine interest, congrats bro!!

[@cprhroaehssneteonr5488]

Does this work on all Unix systems? I’d like to know if this can be done on a Mac in any way.

[@test40323]

Congrats on doing an excellent job explaining it. Thanks!

[@vasiliigulevich9202]

Exploit explanation starts at 3:47

[@diobrando7642]

How was this bug discovered?

[@LowLevelLearning]

manual source code audit. absolutely insane

[@weiSane]

@@LowLevelLearningwoah crazyyy

[@Reydriel]

@@LowLevelLearning That's pretty hardcore lol

[@dengyun846]

That's amazing that someone would just...read the source code like that.

[@diobrando7642]

@@LowLevelLearning That is nuts

[@supergamerfr]

Thank you for the quality content don't hesitate to go super go level and in depth I love it

[@learnidotapp]

Subscribed 😊🎉 great content

[@disieh]

I get freelist is probably the prime example where to use linked lists over other alternatives, but for sake of argument assume freelist would have been a plain array (or vector). Would that have prevented the abuse from double free? (Yes I know fixing the double-free is the first priority)

[@kenny-ze8eg]

So, this information only makes my situation way more puzzling to me. My respect for you guys is beyond comprehensive. I just wish I could cling onto the information and actually put it into play to fix my situation.

[@itskarudo]

you should definitely do more detailed exploit writeup videos! :)

[@epolpier]

He acknowledges himself that this is sth beyond his knowledge so better not try it...

[@carlynghrafnsson4221]

I had this question over "immutable" os utilizing overlayfs, and escaping containers and chroot in this low level way.

[@mihai6977]

dude i'm high on shrooms rn this is insane.

[@anonymouseovermouse1960]

Highly based

[@mihai6977]

;p

[@WreeperXD]

asa e frate

[@eliotmansfield]

as someone who spent his teenage years in the 80’s aligning floppy disks who also had an engineering background - I always found that disks would run far more concentrically if you lowered the disk clamp slowly to give the cone a chance to clamp the disk correctly

[@ryangrogan6839]

Soooo, what is vulnerable to this? Is this something that can happen if you have a socket based connection? Do you need access before escalating? Itd be nice to know how to protect myself and not just how they do it.

[@nou712]

This windows users priorities are not to inform linux users like yourself. It is a local privesc so unless someone accesses your system you're fine. If you install buggy software from GNOME and their diverse programmers you open up more privesc possibilities.

[@Pharoah2]

It has been patched for months so unless you’ve manually disabled security updates you are not vulnerable

[@Pharoah2]

@@lawrencemanning not your fault. I have no idea why he didn’t mention it in the video.

[@anthonybernstein1626]

@@lawrencemanningProcess namespaces are enabled by default on most distros. A quick way to check is cat /proc/self/uid_map. If it exists, you have user NS.

[@AllForMarketing]

modprobe? You should sign the module if you are using secure boot, right? Does the exploit work with secure boot? kinda tired to look for my self r8 now :)

[@cj.wijtmans]

I dont even use modules. Run a custom kernel with whatever i need enabled or disabled.

[@davidyanceyjr]

So how do you double free the kernel without being root? Or another privelaged user?

[@joshuaa3075]

When do you anticipate this to be fixed and various distro's available?

[@burnstick1380]

Newer Kernels (6.7+) have this already patched.

[@johnkallimanis1599]

I run the CVE testing code from the github account on a very recent (and patched) kernel and it froze and crashed the system. Very interesting

[@jama211]

Thank you for having a correct title, seen some people saying stuff like "linux got wrecked". I appreciate your title game more for being truthful.

[@Z3rgatul]

So, who was affected by this? Any system? Or just very specific network configuration?

[@CFSworks]

Looks like any unpatched Linux system newer than 3.15 (!!) with USERNS enabled. So... the vast majority of them. A mitigation is to set the sysctl kernel.unprivileged_userns_clone=0

[@garrettsmith5760]

Why would a double free imply a use after free in this case? Are you saying that the memory was freed, and then the attacker somehow induced an allocation at that moment? Knowing that the 2nd free would soon occur?

[@user-pd5ot4zd4b]

Sweet 'sploit, scary 'sploit. It must have been there for a long time and I wonder what other well resourced adversaries were sitting on it in a zeroday portfolio. Appears to require a local user, but also seems to be the kind of thing that might be projected through a web service bug into a RCE.

[@jonclement]

what tool created that flowchart? it's svg based..

[@spencernold7121]

"In 2016, about 8 years ago", god damn man, you're making me feel old

[@chrissimpson1183]

So could the same thing be done on Mac OS since it is based on UNIX like LINUX is?

[@DeusGladiorum]

You should do a video on the most impactful or crazy bugs of all time, or perhaps per decade/computing era

[@ACium.]

Nice one

[@stefan8410]

I wish there was a linux/bsd channel ran by someone who actually knew anything.

[@TeslaExplorer]

Appreciate the lecture!

[@4.0.4]

I love how the author made such a cool graphic instead of just writing about it. It's clearly a lot of steps.

[@unguidedone]

with grsecurity kernel hardening you should be fine but ill have to test anyway

[@00jknight]

I wanna see the faulty code path that can cause the double free and what the mitigation is.

[@downwardtumble4451]

“Dirty Cow” sounds like it would be a drink in Wisconsin lmao

[@BacklTrack]

I usually kinda understand a lot of general exploit stuff but this is just insane

[@TheEtrepreneur]

this video finished too soon!! Very simple explanation, this dude might be a great teacher.

[@0oNoiseo0]

explaiend really well! thank you

[@David-XCsoaring]

This video was fascinating to listen to as a Linux fan but if I am honest, I have no idea what he is talking about. This is on another level way over my head.

[@alexlefevre3555]

That visual aid chart is very Charlie from It's Always Sunny-esque.

[@heitormbonfim]

I'm loving your Cybersecurity stuff. That's the future

[@dck8740]

What is the best way to learn Win32 API and Windows exploitation?

[@pixelgameing]

Is it possible to use this exploit to get root access on a Android device?

[@misterrreco2535]

I'm proud I was able to understand half of this after my OS college classes

[@michasmarzewski3670]

It's impossible to catch exploit like this in closed source software. Libarchive that was modified by the author of the Linux backdoor is actively used in Windows for more than a year. We know this thanks to Linux being Open Source.

[@yellingintothewind]

Privilege escalation as a class does not depend on exploiting anything in the Linux kernel. It just means gaining permission to do some normally-restricted thing without proper authentication. This _can_ involve a Kernel exploit, but often means targeting set-uid binaries like ping or sudo. Alternatively you can target a service running with the desired permissions. For example, suppose you have a guest user with ssh-only access to a desktop with a running X11 server. This user does not have permission on /dev/input, nor permission to talk to the X server. Further, suppose this is a legacy system with X11 installed setuid. If the user finds a vulnerability in X11 that makes it change permission on an existing X11 socket to 777 before it drops root, the user can use that vulnerability to give himself permission to talk to the primary user's already running X11 server. Then, through the running X11 server, the guest user can listen to the keyboard and mouse or snoop on existing windows. As this is not an intended permission, gained through an exploit, this is a privilege escalation attack. In practice, relatively few privilege escalation attacks use defects in the kernel. Local-user privilege escalation usually involves finding a misconfigured or defective setuid program. There are also remote-user privilege escalations, usually gaining admin rights on a website or similar service. In this case the attacker doesn't even get permission over a new process, just escalated privileges within a specific application.

[@framegrace1]

setuid is not used on linux systems from 2008, where `capabilities` replaced most of its uses, and then we have SELinux on top for a long long long time. Been years without setuid files on any modern system. Non syscall derived escalations are ultra rare (Never heard of any for a long time)

[@dusxmt]

@@framegrace1 There's been several privilege escalations caused by bugs in things like sudo and policykit, some of which have been pretty recent (e.g. due to some of the code in policykit being written in a "clever" (read: hacky) way and not handling argv[0] being NULL correctly, CVE-2021-4034)

[@yellingintothewind]

@@framegrace1 Really? Because `/bin/su` and 12 other binaries in /bin, /sbin/, and /usr/bin are all setuid on my stock ubuntu VM. Sure, granular capabilities have helped, and programs like firejail take advantage of that to even further restrict capabilities of even normal users (which makes escaping firejails a relatively new area of escalation attacks). More than granular capabilities, dbus (and things built on top of dbus like the typical wayland implementations) use posix file handle passing to grant granular access to system resources across users. For example, X11 no longer is setuid because it gets access to /dev/input and the video card resources by asking for them over dbus. The Login1 provider (usually a combination of PAM + (e)logind, running as root) then opens these files and passes handles to them to X11 for session creation. Like with the possible firejail escape above, this means system services like Login1 listening over dbus are now viable attack surfaces for privilege escalation attacks.

[@Ethorbit]

🤓

[@phobos.anomaly]

@@framegrace1 _"Been years without setuid files on any modern system."_ - The system I'm on now has like 20 setuid binaries. I'm pretty sure binaries like su, sudo, passwd, mount, chsh are still setuid on most if not all systems.

[@Aftermost3590]

Instant subscribe. Keep it up

[@kleoCodes]

I'm sick and this vid is already making me happy :)

[@LowLevelLearning]

feel better

[@rlifts]

Requires musl-gcc does this mean it's linked against musl lib? If so it wouldn't work on the majority of Linux systems that use glibc.

[@rajarshikhatua100]

windows/macos also have all kinds of bugs but no one knows because the source is not available

[@edwardmacnab354]

and so is harder to write attacks ?

[@BlueEyedVibeChecker]

Mac has less exploits than Linux and Windows combined. I'm a dualbooter for Win11Pro and Linux Mint and can confirm. Sounds like you're projecting more than anything. "Bu-but, Windows and Mac also do-" That's cool, but is there a bug to exploit who asked?

[@Youtubed-jv5oi]

@@BlueEyedVibeChecker I mean they're not wrong but the point is that Linux is backed by so many companies like Google, Microsoft, Oracle, Intel, AMD, etc so bugs are fixed extremely fast. The mac kernel is also open source. Windows lags behind

[@robertthomas5906]

@@BlueEyedVibeChecker Mac has more exploits than Linux. It's based off of BSD. Back in 2007 they proved the point by porting all the old Linux exploits over to BSD. Now it's not even maintained as well as it was back then. BSD also isn't a mandatory access control kernel. So it's at least 20 years out of date. Don't be fooled, you're not as secure.

[@joelimbergamo639]

​@@BlueEyedVibeCheckerthe fact the nobody tries to find exploits there doesnt mean they dont exist.

[@guyblack9729]

So you're saying now I can run system updates without typing my password?

[@MyReviews_karkan]

This is awesome. Thank you for explaining it.

[@elzabethtatcher9570]

I didn't understand a thing after the graph went up, but I hope kernel patches it soon! Did kernel devs found about this exploit "from the news", or maybe they were given a head start into fixing it?

[@aga5897]

Superb exploitation ! The author of that one must really really have a hands-on grip of Kernel code. Kinda narrows it down some.

[@spambot7110]

0:23 i think the "author of this bug" was probably not using novel techniques, i think they just made a mistake writing some kernel code

[@tremon3688]

He means the one who discovered the bug

[@susugar3338]

Pls tell me when it patched and how i should apply the patch?

[@jonnyso1]

It was patched, just keep your OS updated.

[@scootergirl3662]

LLC has a knack for explaining complicated low level processes in a way noobs can understand, without boring the people that do actually know a bit more. Rare skill.

[@aravindmuthu95]

the moment it is found the repo would have been nuked with pull requests. that's the power of open source

[@pacifico4999]

Sounds a little similar to Asahi Lina's MacOS exploit, that also messed with page tables. At least that second half of the exploit

[@Qstate]

I thought the entire reason we pass syscall argument by registers and not the kernel stack is that those kind of things don't happen.

[@Skyliner_369]

Now the question is, how long will this bug last?

[@VallThyo]

I has been fixed several months ago on 6.7

[@martenkahr3365]

Already gone, for the most part. Discovered in January and already patched in the kernel before the end of January. Downstream distros caught up with this update quickly, too. Ubuntu released the relevant kernel update on their package manager before the end of January, most other distros got it done by the end of February. At this point, the bug only lives in the computers of users that refuse to install security updates.

[@dusxmt]

@@martenkahr3365 Can't forget companies that ship products based off of Linux and don't provide security fixes for them (commonly seen in IoT)

[@BrendonGreenNZL]

@@martenkahr3365 such as every home router or IoT lightbulb out there?

[@svarodzic]

Yes, I definitely learned something here. That I am stupid as a rock! ))) Even though I've been doing system programming for 30 years now.

[@Ch40zz]

many of these techniques are used for windows kernel exploitation quite often

[@ent2220]

Yeah except they don't tell you about it and keep them open on purpose for the NSA, CIA etc. I'm also fairly confident that Bitlocker has a bunch of backdoors as well.

[@rusi6219]

@@ent2220 yeah why use that garbage when veracrypt is available

[@kidnamedfinger.productions]

@@ent2220 Some guy made a video on KZbin how he cracks bitlocker in 50 seconds. Bitlocker is an absolute garbage.

[@seansingh4421]

That’s why really wanna learn eBPF but can’t seem to

[@karolrvn]

Would this double-free be possible in other languages, e.g. Rust?

[@softwarelivre2389]

As data can only have one owner at a time, this is not possible. But we're talking kernel here, so mayne we'd need to use UNSAFE anyway and it could go wrong

[@keithmanning6564]

Privilege escalations do not necessarily exploit kernel code, they could exploit weak applications which have higher privilege themselves