From the 39c3: Escaping Containment: A Security Analysis of FreeBSD Jails

I'll just drop off the kids and head to the train station tomorrow morning. There was no ticket for me, and I had no space in my schedule anyway. Maybe in the afternoon on the plaza at the entry, depends on several things...
 
Well what was the verdict? I see 5 POC in the repo but the first one is using ipf. So 4 POC I care about..

How bad are they?
 
The short of it:
  • There are many kernel subsystems that predate jails and were written with a "root is root" assumption. Later "jail root is not universally root" came in but wasn't completely backpatched to all those subsystems.
  • Some sysctls give kernel data useful to help exploitation, for system stat utilities. This should be solved differently.
  • Using Rust would have prevented a majority of the bugs found (I think they said majority).
  • They also recommend turning on integer overflow/underflow checking if your language supports it.
 
I'm getting a 503 at the moment. So if you get that too, it's not only you.
 
A thing I'm really curious about, would these appear as security advisories? I'm a bit concerned they don't seem to be, but also I'm not familiar with the process.
 
rdog said:
A thing I'm really curious about, would these appear as security advisories? I'm a bit concerned they don't seem to be, but also I'm not familiar with the process.
Click to expand...

Good question. But there are some more code changes to do.
 
You must log in or register to reply here.
Back
Top