If you're on Linux kernel 5.8 or above and have non-root users, patch your kernel ASAP

Daniel15

https://arstechnica.com/information-technology/2022/03/linux-has-been-bitten-by-its-most-high-severity-vulnerability-in-years/

Linux has yet another high-severity vulnerability that makes it easy for untrusted users to execute code capable of carrying out a host of malicious actions including installing backdoors, creating unauthorized user accounts, and modifying scripts or binaries used by privileged services or apps.

Dirty Pipe, as the vulnerability has been named, is among the most serious Linux threats to be disclosed since 2016, the year another high-severity and easy-to-exploit Linux flaw (named Dirty Cow) came to light as it was being used to hack a researcher's server.

https://twitter.com/bl4sty/status/1500822440569708545

More technical details: https://dirtypipe.cm4all.com/

cybertech

what about openvz , lxc ?

Daniel15

@cybertech said:
what about openvz7?

The kernel used by OpenVZ is very old (3.10 for OpenVZ7 and 2.6.32 for OpenVZ6), all containers share that kernel version, and I don't think RHEL backported this change to older kernels, so it should be safe. Yay for outdated software I guess. 🤣

cybertech

ah right. i misread as 5.8 and below.

so latest LXC with 5.11 will be at risk.

Daniel15

I edited the title to clarify.

@cybertech said:
ah right. i misread as 5.8 and below.

so latest LXC with 5.11 will be at risk.

Right. Sorry, I just saw you edited your first comment to mention LXC too.

Boogeyman

Ubuntu is triaging, patch for RHEL 8 is to be released, Debian published patched version for Bullseye.

ezeth

Ahh, and that's why you stick with centos 7, kernel 3.10

skorupion

@ezeth said:
Ahh, and that's why you stick with centos 7, kernel 3.10

So with your logic we should switch back to windows xp/98

ezeth

@skorupion said:

@ezeth said:
Ahh, and that's why you stick with centos 7, kernel 3.10

So with your logic we should switch back to windows xp/98

No that's EOL. Centos 7 goes EOL 2024, with extended life time being 2029

centos 6 still has June 30, 2024 extended EOL https://endoflife.software/operating-systems/linux/red-hat-enterprise-linux-rhel

cmeerw

@Boogeyman said:
Ubuntu is triaging, patch for RHEL 8 is to be released, Debian published patched version for Bullseye.

So why is Ubuntu so far behind? Weren't they already informed at the end of February to prepare an update?

KermEd

@skorupion said:

@ezeth said:
Ahh, and that's why you stick with centos 7, kernel 3.10

So with your logic we should switch back to windows xp/98

Windows XP is great, don't knock it . But seriously why would you use Win XP when Win 3.11 can fit on a floppy disk

skorous

True, you don't want to be in Extended Lifecycle though ...

Tony40

That's why I keep my servers login strictly from my home IP. AllowUsers username@myip
The Internet is a jungle!

Boogeyman

@ezeth said: Centos 7 goes EOL 2024, with extended life time being 2029

You are not going to pay for Extended EOL for sure.

Daniel15

Actually it's really not just non-root sessions and my thread title is still a bit silly... If you have PHP (for example) and executing commands is enabled (for example, proc_open or exec), the hole would be exploitable through that by anyone that can create PHP files on the system.

Boogeyman

@Daniel15 said: Actually it's really not just non-root sessions and my thread title is still a bit silly... If you have PHP (for example) and executing commands is enabled (for example, proc_open or exec), the hole would be exploitable through that by anyone that can create PHP files on the system.

Its completely underrated (yet) than Log4j. Android is effected too. Though I doubt that many device running 5.8 or higher. Usually it's those users who recently moved to RHEL 8 and downstream and Bullseye people.

Daniel15

@ezeth said:
Ahh, and that's why you stick with centos 7, kernel 3.10

Kernel 3.10 has so many missing features though. It's way too old.

You also miss out on performance improvements. The 5.x series has had multiple performance improvements for Ryzen CPUs.

yoursunny

@Boogeyman said:

@ezeth said: Centos 7 goes EOL 2024, with extended life time being 2029

You are not going to pay for Extended EOL for sure.

Don't worry, Boomer will keep the EOL'ed system running well past 2029.
"Not gonna upgrade, what are you expecting on a $3.50/year service?"

ezeth

@Daniel15 said: Kernel 3.10 has so many missing features though. It's way too old.

Like what? Wireguard kernel module? I've already installed that on the 3.10 kernel and as a result you can run your openvz box with kernel Wireguard support

Daniel15

@ezeth said:

@Daniel15 said: Kernel 3.10 has so many missing features though. It's way too old.

Like what? Wireguard kernel module? I've already installed that on the 3.10 kernel and as a result you can run your openvz box with kernel Wireguard support

• Pressure Stall Information (added in 4.20)
• cgroup2 (added in 4.5, improved in 5.2)
• Faster writes for ext4 file systems, via "fast commits" (5.10)
• Various TCP improvements from 4.x and 5.x
• Adiantum data encryption via fscrypt, designed for lower-end devices (5.0)
• Ryzen performance improvements (5.x)
• Better monitoring of AMD hardware (5.x)
• btrfs has significantly improved since 3.10

and probably a bunch more I'm forgetting.

emperor

@ezeth said: Ahh, and that's why you stick with centos 7, kernel 3.10

Dont need to. Check this badass fresh installed without updates :

$ ./a.out /usr/sbin/su
[+] hijacking suid binary..
open failed: No such file or directory
[~] failed
$ ./a.out /usr/bin/su
[+] hijacking suid binary..
open failed: No such file or directory
[~] failed
$ ./a.out /bin/su
[+] hijacking suid binary..
open failed: Permission denied
[~] failed
$ ./a.out /sbin/su
[+] hijacking suid binary..
open failed: No such file or directory
[~] failed
$ uname -r
5.15.19

i tested debian with 5.10 and ubuntu with 5.13 and they go to sh1t

$ ./a.out /usr/bin/su (working with /bin/su also)
[+] hijacking suid binary..
[+] dropping suid shell..
[+] restoring suid binary..
[+] popping root shell.. (dont forget to clean up /tmp/sh ;))
id
uid=0(root) gid=0(root) groups=0(root),1000(*)

Daniel15

@emperor said: Check this badass fresh installed without updates

Did you try it with a different setuid binary other than su?

emperor

@Daniel15 said: Did you try it with a different setuid binary other than su

yes i tried around 10. Only 1 was working but it did not gave root.

./a.out /usr/bin/at
[+] hijacking suid binary..
[+] dropping suid shell..
[+] restoring suid binary..
[+] popping root shell.. (dont forget to clean up /tmp/sh ;))
sh-5.1$ id
uid=1000(*) gid=100(users) groups=100(users),10(wheel)

Those are same as user had before hijacking.

jsg

Oopsie (yet again).

But don't worry because -> "linux is sakkure!!!"

emperor

Slackware patched this one with 5.15.27 kernel update, Also Debian with 5.10.0-12-amd64 #1 SMP Debian 5.10.103-1. I suggest update and restart those who are on debian 5.10.0-10-amd64 or below.