24 ms·
You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)
- rvz 4mo agoAnother one. Linux is falling apart faster than it can assign these CVEs.
- EGreg 4mo agoHow's BSD doing? How about Amazon Linux?
- cachius 4mo agoAnd Windows?
- mschuster91 4mo agoPray to God no one ever lets an AI agent run loose on the various leaked Windows source code dumps. Given Windows' absurd amount of backwards compatibility, chances are pretty high that there are a lot of sleeping dragons buried inside even modern Windows 10/11 kernel and userland that date back to code and issues from the 90s - code where half the people who have worked on it probably not just have departed Microsoft but departed living in the meantime.
- pjmlp 4mo agoWhile true, since MinWin and OneCore that most of that code has been moved around. Also contrary to Linux, Windows 11 (optional on W10) uses sandboxing for kernel and drivers. Since Windows XP SP2 that Windows keeps getting mitigations, Microsoft has security teams whose day job is to attack Windows. They are also promoting using CoPilot for C and C++ code review for some time now. While it won't stop all attacks, it is better than the whole UNIX is safer than Windows attitude from the 90's, turns out it is a matter of how much money is into it. Want really safe above anything else, look into Qube OS with its sandboxing over everything, or mainframe systems like Unysis ClearPath MCP, with NEWP as systems language, and managed environments.
- yjftsjthsd-h 4mo agoAmazon Linux is a Linux distro? Though, yes, I would like to know how the BSDs are doing.
- otterley 4mo agoYes, it's a fork of Fedora. https://docs.aws.amazon.com/linux/al2023/ug/what-is-amazon-linux.html https://docs.aws.amazon.com/linux/al2023/ug/what-is-amazon-l...
- toast0 4mo agoFreeBSD is getting piles of security updates lately too. Not sure about the other BSDs.
- maven29 4mo agoperhaps this will lead to better AppArmor and SELinux defaults?
- ChocolateGod 4mo agoPeople will just turn SELinux off rather than have to go through the horrible tooling when it breaks a regular use case.
- yjftsjthsd-h 4mo agoI do think SELinux is a good example of how robust software with poor UX/DX gets undermined by that poor UX/DX. Although I do wonder if AI can help with it?
- pjmlp 4mo agoThere is also the Android way, this is how it goes, fix your apps.
- pjmlp 4mo agoIt is enabled by default on Android, and only developers can change it temporarly via an ADB session.
- hn92726819 4mo agoFalling apart? You mean getting stronger? Every single one of these is an existing hole being patched. It isn't making new holes
- Gigachad 4mo agoGovernment agencies probably already have half of these exploits in their private toolbox for years now. Finding and patching them is good, but there probably needs to be some systematic change to prevent them rather than just patching bugs when they get found.
- FriedFishes 4mo ago> for years now ZCRX is less than half a year old. I'm so tired boss.
- onjectic 4mo agoSomething something microkernels + capability-based security.
- mattstir 4mo agoI've seen microkernels mentioned a few times between these LPE posts and I'm curious about why. Would they be fundamentally more secure against forgetting to add bounds checking, or assuming user-provided input buffers should be writable without checking?
- Gigachad 4mo agoYes, because as a userspace program if you forget to do bounds checking or read the wrong thing, the kernel kills the process. But if the buggy code is the kernel then there’s no protection. Microkernels aim to have as little code as required in kernel space.
- tgv 4mo agoAs other people said in this thread: so many devices won't be patched. And that can easily lead to users and manufacturers moving away from Linux. Linux is in a glass house.
- gordonhart 4mo agoLinux is "falling apart" because it's the highest-profile open source project people can point LLM agents at to find CVEs. It'll come out the other end of this hardened by all of the attention it's getting, but the next few months/years will be... bumpy.
- staticassertion 4mo agoio-uring is a security nightmare. Constant privescs and a powerful primitive for syscall smuggling. Worth considering disabling it outright (already the case for most containers afaik).
- otterley 4mo agoAt one point, Google disabled io_uring on its production servers (https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html https://security.googleblog.com/2023/06/learnings-from-kctf-...) - I don't know whether this is still true, though. Perhaps a Google can confirm.
- vsgherzi 4mo agosuper curious on this one as well, last I heard they've been enabling it slowly
- m348e912 4mo agoI was reading similar comments about AF_ALG which lead to the copy-fail exploit. Could we see a trend of moving away from less used tools/modules that expand the vulnerability footprint?
- tetha 4mo agoWe at work are currently going through the kernel modules available on Debian by default and deactivating things, yes. And sorry, but I am ... frustrated by this. Why do my Debian 11 servers (currently upgrading, yes) have support for phone infrastructure from the 90s (ATM), or really obscure file systems like "Andrews File System" or support to run IP across amateur radios (AX.25) by default? We recently joked that we should start a pot you add a euro to whenever you find ancient discontinued tech you never heard about our systems support so we can have some nice dinner after this. I do understand that going full Gentoo or Arch as a generally available distro is not feasible. I am also personally intimidated by compiling my own kernel with just what we need. But the amount of strange ancient things supported by default is also quite ridiculous.
- rishabhaiover 4mo agoWhat is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.
- themafia 4mo agoPerhaps it was the prior quiescent period that was the anomaly.
- majorchord 4mo agoAI is happening.
- cachius 4mo agoIn each recent case?
- gordonhart 4mo agoAI assistance was explicitly disclosed on yesterday's. Today's has Claude as one of two contributors on this GitHub Pages site at least so it's also very likely. Agents are capable of finding this kind of stuff now and people are having a field day using them to find high-profile CVEs for fun or profit.
- halJordan 4mo agoI was promised that ai was just a stochastic parrot
- spindump8930 4mo agoSome combination of reporting bias given concerns about LLM security capabilities and actual new vulnerabilities found with LLM assistance. Even if exploits and outages are unrelated to LLMs, I'm certainly thinking about whether claude could build these things (or if actors already have).
- gilrain 4mo agoAutomated vulnerability discovery via LLM.
- baq 4mo agoWhat’s our prior for p(doom) today…?
- FriedFishes 4mo agoI can't quite make out if this is new or not. The attack vector here seems congruent with a similar exploit from a couple months ago [1] But still might be an open threat. On the email thread Jens seems to think that this is already patched and in stable, he also points out that for this exploit to work (as written in the article) you already need escalated privileges [2] Catchy title though. [1] https://snailsploit.com/security-research/general/io-uring-zcrx-race-condition/ https://snailsploit.com/security-research/general/io-uring-z... [2] https://seclists.org/oss-sec/2026/q2/448 https://seclists.org/oss-sec/2026/q2/448
- kro 4mo agoCAP_NET/SYS_ADMIN is required for this. So this would be "not as bad" as the others.
- t0mas88 4mo agoIt could work for container escape?
- kam 4mo agoAlso "The page pool is only created on a real ZCRX-capable NIC (mlx5 ConnectX-6+, Intel E800, NFP)"
- nyrikki 4mo agoIt is a minimal improvement due to the introduction of user namespaces and the fallout from local team convenience for Docker and thus OCI. It is very important that you realize that any capability is a slice of superuser privileges, and there are no implicit protections, only explicit additional constraints that restrict it in reference to root. Look at the bounding set for a normal user on a fresh install of rhel/debian based systems: $ grep ^Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: 000001ffffffffff Note how trivial it is to gain all of those capabilities: $ podman unshare # grep ^Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: 000001ffffffffff CapEff: 000001ffffffffff CapBnd: 000001ffffffffff CapAmb: 0000000000000000 # capsh --decode=000001ffffffffff 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore The capabilities(7)[0] man page will help you with all of those. But capabilities are just a thread local segmentation, which grants superuser or root rights in a vertical segmented fashion. True, if a mechanism chooses to do additional tests based on credentials(7)[1], you can run with those elevated privileges in a lower bound, but that requires implicit coding. Add in that LSMs are suffering from both resources and upstream teams that won't provide guidance or are challenging to work with, and there are literally a hundred commands to either abuse or just ld_preload to get unrestricted userns, allowing you to get around basic controls on clone()/unshare() that may be implemented. $ grep -ir "userns," /etc/apparmor.d/ | wc -l 100 With apparmor every single browser (firefox,chrome,msedge,etc...) as well as busybox, slack, steam, visual studio, ... all have the unrestricted user namespaces and the ability to gain the FULL set of capabilities in the bounding set. If you run `busybox` on a debian system, note how it has nsenter and unshare, so you can't mask those and yet busybox itself is unconstrained with elevated privlages. The TL;DR point being, don't assume that any capability() is in itself a gate, as there are so many ways even for the user nobody to gain them. [0] https://man7.org/linux/man-pages/man7/capabilities.7.html https://man7.org/linux/man-pages/man7/capabilities.7.html [1] https://man7.org/linux/man-pages/man7/credentials.7.html https://man7.org/linux/man-pages/man7/credentials.7.html
- stonegray 4mo ago> “and is writable with CAP_SYS_ADMIN” Am I reading this wrong or is this just a way of executing an arbitrary binary with uid=0 if you have both CAP_NET_ADMIN and CAP_SYS_ADMIN? If you can write modprobe_path, is it really news that you can find a way to execute code?
- pizzalife 4mo agoRight. `CAP_SYS_ADMIN` is for all intents and purposes equivalent to root.
- throwaway7356 4mo agoNo, not since namespacing came around.
- nyrikki 4mo agoNamespaces _may_ result in limits on what you can do with a capability, but a capability is global in scope. If a kernel feature is gated on cap_sys_admin only, it doesn't matter at all what namespace it is in. Namespace support or additional constraints are not implicit and have to be added to each need. People misunderstanding this is partially why we have this latest crop of vulnerabilities.
- cyphar 4mo agoNo, that depends on the kind of privilege check. Some codepaths do ns_capable() (must have capability in owning namespace, reachable via unprivileged user namespaces), some do capable() (must have capability in host user namespace, not reachable via user namespaces at all). ZCRX can only be enabled by passing capable(CAP_NET_ADMIN), so you need to be privileged on the host.
- PlasmaPower 4mo agoNo, you can grant yourself this inside an unprivileged user namespace. `unshare -Ur capsh --print` lists the capabilities inside a user namespace and demonstrates that it has both CAP_SYS_ADMIN and CAP_NET_ADMIN. Almost all distros allow unprivileged user namespaces, and in my opinion this is the right decision, because they're important for browser sandboxing which I think is more important than LPEs.
- saghm 4mo ago[flagged]
- dvt 4mo agoObviously the way to prevent this is by bounds checking, which is literally in the `770594e` patch. It's just a bug and they happen routinely in all languages. Since this is doing pointer arithmetic, it could just as easily happen in unsafe Rust, for example.
- deleted 4mo ago[deleted]
- gpm 4mo agoLike they said, "no way to prevent this" (kind of bug from happening again).
- mikestorrent 4mo agoStatic analysis and other tools can find this, but they're expensive; wonder what the kernel team has access to?
- ivan_gammel 4mo agoTechnically, the kernel team is sufficiently competent to design and build bespoke tools for themselves. It‘s probably a question of risk assessment and priorities.
- PlasmaPower 4mo agoIf static analysis could actually find these issues with a reasonable false positive rate, the companies behind them would be running them on Linux to get the publicity of having found the issues like all the AI companies are doing now. Imo the good static analysis heuristics are already built into compilers or in open source linters.
- 4mo ago
- SubiculumCode 4mo agoDo most servers need this? Or can most of us 'sysctl -w kernel.io_uring_disabled=2 ' ?
- shorden 4mo agoInteresting, I haven't tested this myself but intuitively I think that a 4 byte OOB write is plenty for a data-only attack like [PageJack](https://i.blackhat.com/BH-US-24/Presentations/US24-Qian-PageJack-A-Powerful-Exploit-Technique-With-Page-Level-UAF-Thursday.pdf https://i.blackhat.com/BH-US-24/Presentations/US24-Qian-Page...), so I don't think hardening against the KASLR leaks discussed in OP would necessarily save you from this attack.
- ctoth 4mo agoIf this many are public right now, what does that say about the dark matter of private ones? What's the typical public-private rate for this sort of thing/can someone help me calibrate my base rate expectations?
- dundarious 4mo agoHow many systems have the relevant NICs, and followed the non-automatic setup steps in https://docs.kernel.org/networking/iou-zcrx.html https://docs.kernel.org/networking/iou-zcrx.html, and are not running within a VM/container disabling io_uring? This seems on the low impact end of the numerous historical io_uring issues. Interesting and important all the same.
- pamcake 4mo agoThis kind of post really shouldn't require client-side js — from third-party domain — to read... static markdown version: https://raw.githubusercontent.com/ze3tar/ze3tar.github.io/9d1b00a21214e62968a1451026b20b7af73db4e1/posts/zcrx-freelist-oob.md https://raw.githubusercontent.com/ze3tar/ze3tar.github.io/9d...
- javascripthater 4mo agobig ups pimp
- csmantle 4mo agoI first read this from the author's posting to oss-security. Turns out that the author did agree to revise the blog post for the "admin cap for root shell" part [^0]. [^1] would probably tell more. The title looks like clickbait to me. [^0]: https://www.openwall.com/lists/oss-security/2026/05/08/10 https://www.openwall.com/lists/oss-security/2026/05/08/10 [^1]: https://www.openwall.com/lists/oss-security/2026/05/08/14 https://www.openwall.com/lists/oss-security/2026/05/08/14
- deleted 4mo ago[deleted]
- JoeDohn 4mo agoSo this is another CVE? Or am I misreading this one? "Copy‑fail", "DirtyFrag", now "IUrinegOnYou :)"? Joke aside, we'll see more CVEs in the coming months, and in a sense that's good: it leaves less maneuvering room for bad actors (especially those selling them to the highest bidder).
- himata4113 4mo agohigh privilege access required (CAP/NET admin), containers / sandboxing wins once again. Can we make sandboxing the new default now? Flatpak does a good job, but we're still pretty far away for apt/yum/pacman installed packages. AppArmor was a decent step forward, but clearly not enough.
- pjmlp 4mo agoYes on Android, iDevices, macOS, Windows (UWP, Win32 boxing), Qube OS, but it remains a controversial topic in GNU/Linux land.
- soupbowl 4mo agoI am pretty sure that Flatpak does 'not' do a good job when it comes to sandboxing, maybe one day.
- himata4113 4mo agodoes it not? I know dbus is a problem that they can't really do much about except disabling it and wayland solved display based escalation.
- somebudyelse 4mo agoLet's see... That's 4 Linux LPEs in the last 10 days? Copy Fail [1] Copy Fail 2: Electric Boogaloo [2] Dirty Frag [3] And now this... [1]: https://copy.fail https://copy.fail [2]: https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boo... [3]: https://github.com/V4bel/dirtyfrag https://github.com/V4bel/dirtyfrag
- pocksuppet 4mo agoAren't CF2 and DF the same exploit?
- __bjoernd 4mo agoDirtyFrag and CooyFail2 are two exploits of the same bug. This one is a level less severe.
- teo_zero 4mo ago> Affected: Linux 6.15 – 6.19 [...] Fix: commit 770594e (not yet in any stable branch at time of writing). Is it considered good pactice to publish a vulnerability not yet patched in any stable branch?
- __bjoernd 4mo agoIf you want to claim the fame of being the first with an exploit, responsible disclosure only gets in the way. Same as the CF2 author.
- sherr 4mo agoDesktop and server vulnerabilities are one thing. At least many are actively maintained and will get patched. I have a concern about all the common and cheap internet firewalls and routers that are around, running old software and kernels. Many or most will not get patched. I have some Ubiquiti boxes that are long out of support and run old kernels for instance. The hope is only that there's nothing they expose that gets hit.
- jocelyner 4mo ago[dead]
- danborn26 4mo agoIt is wild how many vulnerabilities are still popping up in io_uring. The attack surface is just so large.
- varispeed 4mo agoSecurity services must be sobbing right now as all the juicy exploits they've been using for years will be patched.