<story><title>Linux kernel use-after-free in Netfilter, local privilege escalation</title><url>https://seclists.org/oss-sec/2023/q2/133</url></story><parent_chain><item><author>snvzz</author><text>There&amp;#x27;s easily thousands of such bugs hidden in the kernel.&lt;p&gt;Reminder the kernel has over ten million LoCs, or megabytes of object code.&lt;p&gt;Perhaps we should start thinking about whether it is a good idea to run something this large in supervisor mode, with full privileges.&lt;p&gt;I wouldn&amp;#x27;t say it is sensible in a world where seL4 exists.</text></item></parent_chain><comment><author>akvadrako</author><text>It won&amp;#x27;t make that big of a difference. If you exploit the networking layer you could intercept any local traffic, which will mostly be unencrypted, and communicate with outside attackers. You are probably owned by that point unless you treated localhost as untrusted.&lt;p&gt;It&amp;#x27;s like why it doesn&amp;#x27;t matter if you are running as root or not. The user account has access to whats important, like a database or keychain.</text></comment>
<story><title>Linux kernel use-after-free in Netfilter, local privilege escalation</title><url>https://seclists.org/oss-sec/2023/q2/133</url></story><parent_chain><item><author>snvzz</author><text>There&amp;#x27;s easily thousands of such bugs hidden in the kernel.&lt;p&gt;Reminder the kernel has over ten million LoCs, or megabytes of object code.&lt;p&gt;Perhaps we should start thinking about whether it is a good idea to run something this large in supervisor mode, with full privileges.&lt;p&gt;I wouldn&amp;#x27;t say it is sensible in a world where seL4 exists.</text></item></parent_chain><comment><author>userbinator</author><text>Alternatively, perhaps we should start thinking about whether it is a good idea to have multiple users of different privilege sharing the same hardware.</text></comment>