You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

https://ze3tar.github.io/post-zcrx.html

42•MrBruh•1h ago

Comments

rvz•1h ago

Another one.

Linux is falling apart faster than it can assign these CVEs.

EGreg•53m ago

How's BSD doing? How about Amazon Linux?

cachius•48m ago

And Windows?

mschuster91•16m ago

Pray to God no one ever lets an AI agent run loose on the various leaked Windows source code dumps.

Given Windows' absurd amount of backwards compatibility, chances are pretty high that there are a lot of sleeping dragons buried inside even modern Windows 10/11 kernel and userland that date back to code and issues from the 90s - code where half the people who have worked on it probably not just have departed Microsoft but departed living in the meantime.

yjftsjthsd-h•11m ago

Amazon Linux is a Linux distro? Though, yes, I would like to know how the BSDs are doing.

otterley•8m ago

Yes, it's a fork of Fedora. https://docs.aws.amazon.com/linux/al2023/ug/what-is-amazon-l...

toast0•11m ago

FreeBSD is getting piles of security updates lately too. Not sure about the other BSDs.

maven29•47m ago

perhaps this will lead to better AppArmor and SELinux defaults?

ChocolateGod•45m ago

People will just turn SELinux off rather than have to go through the horrible tooling when it breaks a regular use case.

yjftsjthsd-h•9m ago

I do think SELinux is a good example of how robust software with poor UX/DX gets undermined by that poor UX/DX. Although I do wonder if AI can help with it?

hn92726819•38m ago

Falling apart? You mean getting stronger? Every single one of these is an existing hole being patched. It isn't making new holes

gordonhart•38m ago

Linux is "falling apart" because it's the highest-profile open source project people can point LLM agents at to find CVEs. It'll come out the other end of this hardened by all of the attention it's getting, but the next few months/years will be... bumpy.

staticassertion•1h ago

io-uring is a security nightmare. Constant privescs and a powerful primitive for syscall smuggling. Worth considering disabling it outright (already the case for most containers afaik).

otterley•9m ago

At one point, Google disabled io_uring in its production servers (https://security.googleblog.com/2023/06/learnings-from-kctf-...) - I don't know whether this is still true, though. Perhaps a Google can confirm.

rishabhaiover•51m ago

What is happening? I see multiple outages and CVEs is being reported on HN's front page. I've never seen these many security/incident related posts on HN's front page.

majorchord•49m ago

AI is happening.

cachius•48m ago

In each recent case?

gordonhart•39m ago

AI assistance was explicitly disclosed on yesterday's. Today's has Claude as one of two contributors on this GitHub Pages site at least so it's also very likely.

Agents are capable of finding this kind of stuff now and people are having a field day using them to find high-profile CVEs for fun or profit.

spindump8930•48m ago

Some combination of reporting bias given concerns about LLM security capabilities and actual new vulnerabilities found with LLM assistance. Even if exploits and outages are unrelated to LLMs, I'm certainly thinking about whether claude could build these things (or if actors already have).

gilrain•48m ago

Automated vulnerability discovery via LLM.

john_strinlai•39m ago

i believe a good portion of the cves hitting the front page are moreso because they are ai-related (found partially/in whole by ai) and make for quick upvotes.

NitpickLawyer•35m ago

> What is happening?

Slowly at first, and then suddenly. AI assisted anything follows this trend. As capabilities improve, new avenues become "good enough" to automate. Today is security.

baq•47m ago

What’s our prior for p(doom) today…?

FriedFishes•47m ago

I can't quite make out if this is new or not. The attack vector here seems congruent with a similar exploit from a couple months ago [1]

But still might be an open threat. On the email thread Jens seems to think that this is already patched and in stable, he also points out that for this exploit to work (as written in the article) you already need escalated privileges [2] Catchy title though.

[1] https://snailsploit.com/security-research/general/io-uring-z... [2] https://seclists.org/oss-sec/2026/q2/448

kro•38m ago

CAP_NET/SYS_ADMIN is required for this. So this would be "not as bad" as the others.

stonegray•30m ago

> “and is writable with CAP_SYS_ADMIN”

Am I reading this wrong or is this just a way of executing an arbitrary binary with uid=0 if you have both CAP_NET_ADMIN and CAP_SYS_ADMIN?

If you can write modprobe_path, is it really news that you can find a way to execute code?

pizzalife•13m ago

Right. `CAP_SYS_ADMIN` is for all intents and purposes equivalent to root.

Google Cloud Fraud Defence is just WEI repackaged

Discord Incident

AI is breaking two vulnerability cultures

Man Finds $1M Worth of Yu-Gi-Oh Cards in a Dumpster

Cartoon Network Flash Games

You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

Mux (YC W16) Is Hiring

Serving a website on a Raspberry Pi Zero running in RAM

My first in-prod corrupted hard drive problem

An Introduction to Meshtastic

David Attenborough's 100th Birthday

Looking at the data behind prediction markets

Roadside Attraction

Google Broke reCAPTCHA for De-Googled Android Users

A web page that shows you everything the browser told it without asking

PC Engine CPU

Rumors of my death are slightly exaggerated

Cloudflare to cut about 20% of its workforce

Mojo 1.0 Beta

Show HN: GETadb.com – every GET request creates a DB

Apple, Intel have reached preliminary chip-making deal

Poland is now among the 20 largest economies

How do I deal with memory leaks? (2022)

Canvas online again as ShinyHunters threatens to leak schools’ data

US Government releases first batch of UAP documents and videos

Maybe you shouldn't install new software for a bit

Podman rootless containers and the Copy Fail exploit

Show HN: Git for AI Agents

Ask HN: We just had an actual UUID v4 collision...

Dirtyfrag: Universal Linux LPE

You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

Comments

Google Cloud Fraud Defence is just WEI repackaged

Discord Incident

AI is breaking two vulnerability cultures

Man Finds $1M Worth of Yu-Gi-Oh Cards in a Dumpster

Cartoon Network Flash Games

You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)

Mux (YC W16) Is Hiring

Serving a website on a Raspberry Pi Zero running in RAM

My first in-prod corrupted hard drive problem

An Introduction to Meshtastic

David Attenborough's 100th Birthday

Looking at the data behind prediction markets

Roadside Attraction

Google Broke reCAPTCHA for De-Googled Android Users

A web page that shows you everything the browser told it without asking

PC Engine CPU

Rumors of my death are slightly exaggerated

Cloudflare to cut about 20% of its workforce

Mojo 1.0 Beta

Show HN: GETadb.com – every GET request creates a DB

Apple, Intel have reached preliminary chip-making deal

Poland is now among the 20 largest economies

How do I deal with memory leaks? (2022)

Canvas online again as ShinyHunters threatens to leak schools’ data

US Government releases first batch of UAP documents and videos

Maybe you shouldn't install new software for a bit

Podman rootless containers and the Copy Fail exploit

Show HN: Git for AI Agents

Ask HN: We just had an actual UUID v4 collision...

Dirtyfrag: Universal Linux LPE