Conversation

Notices

1. Embed this notice
   Hailey (hailey@hails.org)'s status on Friday, 08-May-2026 09:06:39 JST Hailey

   • Rich Felker

   @dalias oh there's an even newer one! https://www.openwall.com/lists/oss-security/2026/05/07/8

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Friday, 08-May-2026 09:06:38 JST Rich Felker

     in reply to

     @hailey Dirty frag is the same thing, just less clear what it's doing,

   • Embed this notice
     Hailey (hailey@hails.org)'s status on Friday, 08-May-2026 09:12:06 JST Hailey

     in reply to

     • Rich Felker

     @dalias oh wait no, I've got it mixed up. I think you're right

   • Embed this notice
     Hailey (hailey@hails.org)'s status on Friday, 08-May-2026 09:12:06 JST Hailey

     in reply to

     @dalias hold up, I see the iproute2 shell out. I disagree, I think AF_NETLINK is quite relevant. If you block that address family, you block the exploit. Most programs have no need for that address family, so it's unnecessary exposure. I'll revise my position when I see a poc which does not use AF_NETLINK

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Friday, 08-May-2026 09:22:01 JST Rich Felker

     in reply to

     @hailey That's what I said. You need a way to setup the network interfaces to exploit this, but it's fundamental that, if you can setup virtual network interfaces as a user, you can exploit this. The fact that AF_NETLINK is the mechanism by which you set them up isn't particularly important.

     Yes, you could cut off access to this one by preventing users from doing that, in a number of ways. Blocking netlink is just one. You could also nuke user namespaces. But now all sorts of stuff which in principle shouldn't be privileged needs suids, opening up net attack surface...

     Note that killing AF_NETLINK would break some libc interfaces applications might use, including at least mq_notify, getifaddrs, if_nameindex.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Friday, 08-May-2026 10:52:43 JST Rich Felker

     in reply to

     @hailey If I wanted a big hammer to cut off this whole class of vuln without impacting important functionality, though, I'd just setup a global seccomp filter to block SYS_splice and related syscalls, or patch them out of the syscall table.