Egregoros · Phoenix Framework

Timeline

Post

Remote status

Context

mc.fly

@mcfly@milliways.social remote

https://lwn.net/Articles/1071719/

#DirtyFrag is a broken embargo.

Local Privilege Escalation to root.

Public working exploit. No CVE assigned yet.

No fix in sight.
<Edith> 7.0.5 was just released which has a fix <\Edith>

#infosec #cyber #tsunamiofvulns

This is the documentation & exploit of DirtyFrag:
https://github.com/V4bel/dirtyfrag/blob/master/README.md

mc.fly

@mcfly@milliways.social remote

There seen to be a fix in commit https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4

That fix made it into 7.0.5 which was released 30 mins (?) ago

https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.5

#dirtyfrag

MikeTangoortcloud

@miketango@chaos.social remote

@mcfly What do they mean by "embargo has been broken"? Someone just willy nilly published that exploit before the distro / kernel guys could react?

mc.fly

@mcfly@milliways.social remote

@miketango from what I can read in the discussion is that someone saw the fix in the commit and asked a LLM too build an exploit and published that.

That someone was not aware of an embargo

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4

Caleb James DeLisle

@cjd@pkteerium.xyz remote

I keep trying to find applications for LLMs in my work, and generally I find that they're pretty stupid.

But from the wash of recent security vulns that have been getting found, it's pretty clear that in the right hands, they are proving to be a very sharp tool.

Replying to @cjd@pkteerium.xyz

FourOh-LLC

@FourOh-LLC@pkteerium.xyz remote

Web3, Blockchains, Crypto, IPFS, - all the moving parts are there. None of them is without a purpose. I invested my future into IPFS, which is not blockchain - which is better because IPFS is trivial. The weaknesses are very noisy and it won't scale, but a weakness is not always bad: its like the crumble zone in the car, its engineered to give.

I see absolutely nothing wrong with the future.

Replies

Replying to @FourOh-LLC@pkteerium.xyz

FourOh-LLC

@FourOh-LLC@pkteerium.xyz remote

Which reminds me to ask anyone who has garbage crypto they no longer have a use for to send it to 0xcfC84dF3C1811ee3307f7DDd383B77076487B71b

This is not begging for donations, it will be used in the Web3 project I am building, a Roman 100BC - 100AD simulator (not a game). Send the receipt to postmaster at kane-il.us if you want credit, or want to plug your own project.

Again, do not send eth or bitcoin -send BAT and other junk, must be on Etherum though. kane-il.us is in the breave creator networks, you can send BATs from the browser.