My concern is to try to understand the mechanisms of the exploit.
Copy Fail is not simply ”hey, kernel, give me root”. I would say it’s more general than that. It’s rather: ”Hey, kernel, when you present file /foo to a process, make the contents of that file appear according to my wishes”. Which can be used (in various ways) to advance the attacker’s position.
That’s why I think it’s interesting to ponder if that power allows the attacker to simply sneak past security policies such as allowPrivilegeEscalation=false.
Residing in Södermanland, Sweden.
Get in touch? E-mail: c (at) tunnel53 (dot) net
Website: https://www.tunnel53.net/
Interesting HN people to follow: ('tptacek 'cperciva 'tlb 'FiloSottile 'Animats 'DannyBee 'mcpherrinm 'phasmantistes 'pbsd 'patio11)