22
Google pays $250K for Linux vulnerability allowing guest VM escapes (arstechnica.com)
submitted 4 months ago by to c/news@lemmy.linuxuserspace.show
1 comment fedilink hide all child comments

1 comment

sorted by: hot top controversial new old
[–] 4 points 4 months ago*

Didn't they refuse to pay out a big exploit already? Was it a different company?

Edit: I misunderstood. They bought an existing one, not put up a bounty for one.

  • permalink
  • fedilink
  • source
    •
    42 comments in c/selfhosted@lemmy.world view that post
    [–] 101 points 4 months ago (14 children)

    A separate vulnerability in Linux allows users with limited rights to escalate to root. Tracked as CVE-2026-43499, it lurked in the OS for 15 years. Researchers from Nebula Security said they discovered it using Vega, Nebula’s AI-assisted vulnerability scanner. Matt Lucas, a researcher and founder of RedEye Security, explained

    This will become more and more common as we use AI to find vulnerabilities faster (hopefully) than bad actors can use AI to find vulnerabilities.

  • permalink
  • fedilink
  • source
  • hideshow 14 child comments
    •
  • [–] 87 points 4 months ago (5 children)

    If you pay attention you can hear a hundred NSA assholes tear their hair out

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 42 points 4 months ago* (last edited 4 months ago) (1 child)

    20 years of hoarding CVEs down the drain.

    Now they'll never be able to gg ez their way into any country and will have to actually use their bribery budget to get more implants lol.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 21 points 4 months ago (1 child)

    Keep in mind that the rate of errors caught by AI will not be consistent. It will drop off over time.

    While I'm no fan of AI, that has nothing to do with it. Adding AI to error detection suites is (mostly) fine so long as you don't remove more tradional methods like code review, manually set up unit tests, and properly reviewing each failed test instead of just letting the AI slop in a patch.

    My point is that any test you add to an existing codebase is going to catch a decent number of issues at first, then over time it will drop off as pre-existing issues get resolved. Then you'll be left with the lower rate of new issues from updates.

    AI isn't a silver bullet. It (sometimes) is another tool in the toolbox.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [+] -19 points 4 months ago (5 children)

    as we use AI to find vulnerabilities faster (hopefully) than bad actors can use AI to find vulnerabilities.

    Oh small, simple child: who do you think has the better access to AI in the first place?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 24 points 4 months ago* (1 child)

    This is a reminder that US scientists during the cold war thought fish were russian subs because they didn't have biologists on staff

    Judging by the way they've treated big companies in the past the NSA is staffed by a bunch of people who use backroom deals with US tech companies to collect their data mostly.

    I actually think a large plurality of them spend most their time tracking/stalking their wives and like people they argued with the day before.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 8 points 4 months ago (2 children)

    small, simple child:

    Didn't downvote you but.....

    LOL! The level condescension sure is right on point Lemmy.That genuinely got a chuckle. In some ways I enjoy being that simple child. Full of wonderment at this universe around him.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 77 points 4 months ago (4 children)

    If it was microsoft they would ban github and gitlab account and not give cve.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] [S] 43 points 4 months ago (2 children)

    I'm not a big Google fan but I will give credit where credit is due

    They do put their money where their mouth is

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • [–] 6 points 4 months ago (1 child)

    Google uses https://github.com/google/gvisor in GCP. So it’s not affected by most vulnerabilities like this. But still makes sense they want the tech. Vm escapes would be really bad for them.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 3 points 4 months ago

    Oh AWS is gonna be spicy this week.

  • permalink
  • fedilink
  • source
    •
    [+] -81 points 4 months ago* (last edited 4 months ago) (18 children)

    Linux's "security through obscurity" was never going to last.

    Edit: it's a common concept in hacking. Shorthand for a type of security through improbability.

  • permalink
  • fedilink
  • source
  • hideshow 18 child comments
    •
  • [–] 38 points 4 months ago

    Linux's "security through obscurity"

    I lost braincells reading this. The entire point of open source software is to have it visible and auditable, aka the exact opposite of security through obscurity.

    If you want to bash OS's for relying on STO, go after iOS and Windows. Those OS's, being closed source, are the ones relying on it

  • permalink
  • fedilink
  • source
  • parent
  • [–] 33 points 4 months ago (2 children)

    I don't know where you got the notion from that Linux as a whole uses this concept, but it's nonsense. There's exactly one place where this definition fits, which is the GRUB bootloader encryption (which merely shifts the target for the Evil Maid attack from the initramfs to GRUB). But this is already adressed with Verified Boot.

    Nothing else, let it be LUKS, PAM, SELinux, AppArmor or whatever has any business with STO.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [+] -33 points 4 months ago* (1 child)

    From the fact it used to have to smallest user base of the big three. Less users = less probability of a nefarious person.

    It's really not that difficult a concept. I'm surprised people here are asking what it is.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 27 points 4 months ago

    That doesn't make any sense as argument no matter how you spin it. Linux is the dominant system for servers for decades now, and a Debian Desktop is quite literally the same as Debian on a server except it also got a GUI of your choice slapped on top. There's absolutely nothing obscure about it, neither did anyone from the kernel team (Linux), FSF (GNU utils) nor IBM / Red Hat (systemd & honestly way too much other stuff) etc. ever design something around STO. That's a domain firmly situated in proprietary code since for FOSS it doesn't make sense to begin with. The false errand of GRUB is the sole exception, well known and solved.

    The desktop market share says absolutely nothing about what you're trying to argue. Now if you were to argue that Linux is lacking in terms of desktop software isolation then you'd have a point, things like Flatpak still are addressing lots of issues. But to say "Linux" approaches security with obscurity is total nonsense.

  • permalink
  • fedilink
  • source
  • parent
  • [+] -14 points 4 months ago (10 children)

    The self-hosted crowd thinks reverse proxies protect you from the Internet. Don't expect too much of them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 10 points 4 months ago* (last edited 3 months ago) (6 children)

    The selfhosted guys are correct with that. Of course its not a magic pill, but it can help to minimize the attack surface immensely with little effort.

    Edit: while open ports can easily be enumerated, a reverse proxy often requires knowledge of the right server name. In tls1.3 those are not transferred in clear. Depending on your threat scenario you might want to consider doh/dot etc.

    Reverse proxies can require client certs, which lift the security benefit to something like a vpn. Even basic auth adds a high threshold to attackers and is simple even for random users to work with. All this is functionality many services don't offer natively - as they assume a reverse proxy anyway I guess.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [+] -12 points 4 months ago* (last edited 4 months ago) (5 children)

    See what I mean?

    As if a proxy blindly passing traffic directly to a backend server "reduces attack surface" in any meaningful way. 🙄

    Edit: Guy edits his post with a bunch of stuff and assumes I've read it later. I can't eyeroll enough...

    1. You've increased your "attack surface" by adding a second application to the stack. Proxies aren't magic, they are also targets.
    2. Sure - you can do those things on a proxy. How many people here are? And why are those things never suggested when people here say "use a reverse proxy"? Because they think the proxy is the security.
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 4 points 4 months ago (4 children)

    Did you just add 'blindly passing traffic' to your statement? Did you read my comment about can help?

    Move on, joker.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [+] -7 points 4 months ago* (3 children)

    Sorry - which part of your comment added anything of value? "can help to minimize the attack surface"? 99% of the time a proxy just passes traffic through. Unless you're talking about a WAF which is a) a different thing and b) NOT what any home gamers are talking about when they recommend nginx, traefik, etc. to newbs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 3 months ago (1 child)

    There’s also a big brigading problem with going against the “common knowledge” of Lemmy. Brave can do no good. Reverse proxy on the internet and you’re secure. Etc.

    That your comment is downvoted and barely debated speaks volumes to Lemmy as actual discourse.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 months ago* (last edited 3 months ago)

    It's being downvoted with relatively little discourse because it's an insult with no relevance to the topic, in addition to supporting a comment from someone who is either trolling or has no idea what they're talking about

  • permalink
  • fedilink
  • source
  • parent
    • 7 comments in c/cybersecurity@sh.itjust.works view that post
    [–] 1 point 3 months ago

    Bug bounties continue paying off.

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 3 months ago (5 children)

    Can't wait to see the day where Linux Kernel is 100% written in Rust

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 7 points 3 months ago (3 children)

    And if you think that migration to Rust will magically remove all bugs and vulnerabilities, you haven't been writing software for very long.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 3 months ago

    Nobody said it would? But both of these vulnerabilities were use-after-free, so using Rust would probably have helped here (you know if Rust had been a thing back when they were introduced).

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 3 months ago

    Something else will come along with an entourage of fanboys pushing for it to be the next porting language.

    It'll be great; until the next one comes along.

    By then the kernel will be so slow that Linux will die.

  • permalink
  • fedilink
  • source
  • parent