FRESH

Hacker News

GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

101 points by djfergus

by goodburb

1 subcomments

Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older).
Two boot looped, I had to enter recovery and the other just powered off [0].
The demo modifies the wallpaper on supported Pixel devices.
[0] IonStack https://rootme.nebusec.ai
____
Tip: Install a Chromium flavor browser (Chromite) separate from the main browser.
Disable Javascript and hardware accelerated video decoder (commonly exploited) from the flags page and enable reader mode to fix broken JS-dependent websites when browsing blogs and random sites on your personal devices, else dedicate a tablet.

by password4321

2 subcomments

Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.

by amatecha

0 subcomment

Daaaaamn: "GhostLock was introduced in Linux 2.6.39 and fixed in Linux 7.1."

by teleforce

1 subcomments

>Google has rewarded us $92,337 in kernelCTF
I'm all ears now

by ranger_danger

2 subcomments

dupe of https://news.ycombinator.com/item?id=48834309

by

0 subcomment

by mixmastamyk

2 subcomments

A what?