Search cyberveille.decio.ch

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]

#avast #EN #2022 #Rootkit #Linux #Syslogk #malware #Adore-Ng

·decoded.avast.io·Jun 14, 2022

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]

#avast #EN #2022 #Rootkit #Linux #Syslogk #malware #Adore-Ng

·decoded.avast.io·Jun 14, 2022

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]

#avast #EN #2022 #Rootkit #Linux #Syslogk #malware #Adore-Ng

·decoded.avast.io·Jun 14, 2022

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]

#avast #EN #2022 #Rootkit #Linux #Syslogk #malware #Adore-Ng

·decoded.avast.io·Jun 14, 2022

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]

#avast #EN #2022 #Rootkit #Linux #Syslogk #malware #Adore-Ng

·decoded.avast.io·Jun 14, 2022

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]

#avast #EN #2022 #Rootkit #Linux #Syslogk #malware #Adore-Ng

·decoded.avast.io·Jun 14, 2022

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]

#avast #EN #2022 #Rootkit #Linux #Syslogk #malware #Adore-Ng

·decoded.avast.io·Jun 14, 2022

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.

#CVE-2022-0847 #dirtypipe #Linux #Kernel #arbitrary #privilege #escalation #vulnerability #EN #2022

·dirtypipe.cm4all.com·Mar 7, 2022

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

Compromised PyTorch-nightly dependency chain between December 25th and December 30th, 2022.

If you installed PyTorch-nightly on Linux via pip between December 25, 2022 and December 30, 2022, please uninstall it and torchtriton immediately, and use the latest nightly binaries (newer than Dec 30th 2022). $ pip3 uninstall -y torch torchvision torchaudio torchtriton $ pip3 cache purge PyTorch-nightly Linux packages installed via pip during that time installed a dependency, torchtriton, which was compromised on the Python Package Index (PyPI) code repository and ran a malicious binary. This is what is known as a supply chain attack and directly affects dependencies for packages that are hosted on public package indices.

#PyTorch #EN #2022 #Linux #pip #Compromised #dependency #Supply-chain-security

·pytorch.org·Jan 2, 2023

Compromised PyTorch-nightly dependency chain between December 25th and December 30th, 2022.

Chaos is a Go-based Swiss army knife of malware

Black Lotus Labs, the threat intelligence arm of Lumen Technologies, recently uncovered a multifunctional Go-based malware developed for Windows and Linux

#lumen #EN #2022 #Chaos #Go #malware #Windows #Linux #IoCs

·blog.lumen.com·Sep 30, 2022

Chaos is a Go-based Swiss army knife of malware

Shikitega - New stealthy malware targeting Linux

AT&T Alien Labs has discovered a new malware targeting endpoints and IoT devices that are running Linux operating systems. Shikitega is delivered in a multistage infection chain where each module responds to a part of the payload and downloads and executes the next one. An attacker can gain full control of the system, in addition to the cryptocurrency miner that will be executed and set to persist.

#cybersecurity.att.com #AT&T-Alien-Labs #Shikitega #EN #2022 #Linux #malware #Analysis

·cybersecurity.att.com·Sep 7, 2022

Shikitega - New stealthy malware targeting Linux

Linux Kernel Exploit (CVE-2022-32250) with mqueue

Netfilter is a framework in the Linux kernel for implementing various networking-related tasks with user-defined handlers. Netfilter provides various functions for packet filtering, network address translation and port translation, and packet logging. Netfilter represents a set of hooks that allow other kernel modules to register callback functions in the kernel’s networking stack.

#theori #EN #2022 #exploit #Linux #mqueue #CVE-2022-32250 #Kernel

·blog.theori.io·Aug 26, 2022

Linux Kernel Exploit (CVE-2022-32250) with mqueue

Vulnerability in Linux containers – investigation and mitigation

Operating system access controls, that constrain which programs can open which files, have existed for almost as long as computers themselves. Access controls are still widely used and are more flexible and efficient when compared to cryptographically protecting files. Despite the long history, ther

#benthamsgaze #EN #2022 #constrain #Linux #containers #investigation #Access #controls

·benthamsgaze.org·Aug 23, 2022

Vulnerability in Linux containers – investigation and mitigation

Kaspersky report on Luna and Black Basta ransomware

This report discusses new ransomware, that targets Windows, Linux and ESXi systems: Luna written in Rust and Black Basta.

#securelist #EN #2022 #Luna #Rust #BlackBasta #Cross-platform-malware #Cybercrime #Data-Encryption #ESXi #Linux #Malware-Descriptions #Malware-Technologies #Microsoft-Windows #Ransomware #Targeted-attacks

·securelist.com·Jul 22, 2022

Kaspersky report on Luna and Black Basta ransomware

[CVE-2022-34918] A crack in the Linux firewall

In our previous article Yet another bug into Netfilter, I presented a vulnerability found within the netfilter subsystem of the Linux kernel. During my investigation, I found a weird comparison that does not fully protect a copy within a buffer. It led to a heap buffer overflow that was exploited to obtain root privileges on Ubuntu 22.04.

#randorisec #EN #2022 #CVE-2022-34918 #Linux #netfilter #Vulnerability #analysis

·randorisec.fr·Jul 21, 2022

[CVE-2022-34918] A crack in the Linux firewall

The US military wants to understand the most important software on Earth

Open-source code runs on every computer on the planet—and keeps America’s critical infrastructure going. DARPA is worried about how well it can be trusted

#technologyreview #EN #2022 #Linux #DARPA #kernel #trust #US

·technologyreview.com·Jul 15, 2022

The US military wants to understand the most important software on Earth

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]

#avast #EN #2022 #Rootkit #Linux #Syslogk #malware #Adore-Ng

·decoded.avast.io·Jun 14, 2022

Linux Threat Hunting: 'Syslogk' a kernel rootkit found under development in the wild

Symbiote: A New, Nearly-Impossible-to-Detect Linux Threat

Symbiote is a new Linux malware we discovered that acts in a parasitic nature, infecting other running processes to inflict damage on machines.

#intezer #2022 #EN #research #Symbiote #malware #BPF #Linux #Threat

·intezer.com·Jun 10, 2022

Symbiote: A New, Nearly-Impossible-to-Detect Linux Threat

Put an io_uring on it: Exploiting the Linux Kernel - Blog |

At Grapl we believe that in order to build the best defensive system we need to deeply understand attacker behaviors. As part of that goal we're investing in offensive security research. Keep up with our blog for new research on high risk vulnerabilities, exploitation, and advanced threat tactics.

#Graplsecurity #en #2022 #0-day #Linux #kernel #exploit #redteam #research

·graplsecurity.com·Jun 4, 2022

Put an io_uring on it: Exploiting the Linux Kernel - Blog |