[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <d9038011-c2e9-407c-b28b-8461e995df1f@benhays.org>
Date: Thu, 7 May 2026 21:24:18 -0400
From: Benjamin Hays <ben@...hays.org>
To: oss-security@...ts.openwall.com
Cc: axboe@...nel.dk
Subject: Re: CVE request: io_uring zcrx freelist OOB write
On 5/7/26 18:28, Jens Axboe wrote:
> I won't comment too much on this to avoid offending anyone, but I'm a
> bit puzzled by:
>
> "Once we have the address of modprobe_path (from KASLR step above), we
> write our script path via /proc/sys/kernel/modprobe: c
>
> int fd = open("/proc/sys/kernel/modprobe", O_WRONLY);
> write(fd, "/var/tmp/evil.sh", 16);
>
> This sysctl entry writes directly into modprobe_path in kernel memory
> and is writable with CAP_SYS_ADMIN, which we already have via
> CAP_NET_ADMIN on container configurations that grant both."
>
> as surely the point of a local exploit is, in fact, to gain root in the
> first place. If you already have CAP_SYS_ADMIN, what is the point?
>
> But hey, someone wrote a blog post about something that sounds
> dangerous.
I'm not the original author of the blog post, so I can't speak for their
intent; however, I imagine the impact for the proposed scenario would a
container escape of some kind? It's not exactly uncommon to see
containers with lax permissions such as the above, given under the
assumption that the underlying containerization technologies will
provide a sufficient level of security.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
