Hacker News Reader

Comment by yjftsjthsd-h | Hacker News Reader

I think it's misleading to label this "Debian/Ubuntu privilege escalation"; it's a Linux kernel local exploit, that happens to be confirmed to apply to Debian and Ubuntu.

(Edit: Because when I read "Debian/Ubuntu privilege escalation PoC exploit for CVE-2024-1086" my first thought was something like, "Oh, is it in apt-get? Or is this another distro patch gone wrong?")

View on HN

You're not necessarily wrong, although simply saying "Linux" isn't accurate either because it's in part a vuln exposed by a specific kconfig, which differs by distro. From the caveats section:

> The exploit does not work v6.4> kernels with kconfig CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y (including Ubuntu v6.5)

> The exploits requires user namespaces (kconfig CONFIG_USER_NS=y), that those user namespaces are unprivileged (sh command sysctl kernel.unprivileged_userns_clone = 1), and that nf_tables is enabled (kconfig CONFIG_NF_TABLES=y). By default, these are all enabled on Debian, Ubuntu, and KernelCTF. Other distro's have not been tested, but may work as well.

Also with other distros like Fedora and Arch, the kernel versions change frequently including new big versions (like 6.4 to 6.5, what in semver would be called "minor" but isn't super accurate for the linux kernel) so that list would be outdated very quickly if not immediately (for example my Fedora machine right now is on kernel 6.7.9, way beyond what is vulnerable). It's quite possible that Ubuntu is the only vulnerable distro given the way they manage kernel versions. That's not a criticism of Ubuntu, because there are pros and cons of each approach, but in this case it does probably make Ubuntu more vulnerable. RHEL and derivatives also tend to stick on a version long term, and it looks like RHEL 9.3 is on kernel 5.14 so could be vulnerable but it's at the very beginning of the range. That would be a useful thing to know.

I think it's also (generally) far more useful for most people to hear a descriptor that most closely aligns with something they can readily identify whether it affects them or not. Then people can look at the details themselves.

Edit: added a little more on other distros like Fedora and Arch

Interesting Arch discussion on the security implications of user namespaces when they were considering adding it to their kconfig: https://bugs.archlinux.org/task/36969

> simply saying "Linux" isn't accurate either because it's in part a vuln exposed by a specific kconfig, which differs by distro

True; if the Debian family is unusual in having that config then fair enough, but it sounds like the author just didn't look at others.

> Also with other distros like Fedora and Arch, the kernel versions change frequently including new big versions (like 6.4 to 6.5, what in semver would be called "minor" but isn't super accurate for the linux kernel) so that list would be outdated very quickly if not immediately

Debian/Ubuntu still roll patch releases regularly, so that seems irrelevant; it'll be out of date in short order regardless.

Also, it's already been patched and the vulnerable are the ones who haven't updated.

Thanks for pointing that out, I was confused about that.

The world was given a pretty short time frame to adapt. Now the script kiddies will unleash the hell.

It was patched a month and a half ago which means it was known about before that. So around 30ish days known until the CVE and 60 until this published exploit. IMO this is a decent time frame, how long do you think is enough?

We've changed the title from "Debian/Ubuntu privilege escalation PoC exploit for CVE-2024-1086" as part of changing the URL (see https://news.ycombinator.com/item?id=39830200)

Reply on news.ycombinator.com