Linux kernel use-after-free in Netfilter, local privilege escalation

Re:Linux kernel use-after-free in Netfilter, local privilege... by userbinator on Tuesday May 09, 2023 @10:07PM (#35882793)

Alternatively, perhaps we should start thinking about whether it is a good idea to have multiple users of different privilege sharing the same hardware.

[ Parent | on HN ]

Re:Linux kernel use-after-free in Netfilter, local privilege... by thfuran on Tuesday May 09, 2023 @10:48PM (#35883071)

What's the alternative, just running all code at ring 0?

[ Parent | on HN ]

Re:Linux kernel use-after-free in Netfilter, local privilege... by userbinator on Tuesday May 09, 2023 @11:51PM (#35883452)

IMHO rings 0 + 3 with protections against bugs, and not deliberate malice, is probably the sweet spot.

[ Parent | on HN ]

Re:Linux kernel use-after-free in Netfilter, local privilege... by Aerbil313 on Wednesday May 10, 2023 @03:18AM (#35884639)

https://www.theseus-os.com/

[ Parent | on HN ]

Re:Linux kernel use-after-free in Netfilter, local privilege... by travis729 on Tuesday May 09, 2023 @11:35PM (#35883336)

I’ve been thinking this recently as well.

[ Parent | on HN ]

Re:Linux kernel use-after-free in Netfilter, local privilege... by gizmo686 on Tuesday May 09, 2023 @11:39PM (#35883366)

"User" in a modern Linux system is just a weird name for "security domain". Many programs run as their own user to limit their ability to attack the rest of the system if they get compromised; and limit the ability of a different compromised component from attacking them.

My desktop, on which I am the only person with an account, has 49 "users", of which 11 are actively running a process.

At work, every daemon we run has a dedicated user.

On android, every app runs as its own user.

[ Parent | on HN ]