Post #1833335
2026-04-22 02:54 UTC
Replies (1)
-
@david_chisnall@infosec.exchange 2026-04-22 07:33
@bms48 @downey Two security advisories today were from Claude. One allowed a process to become root due to a kernel use-after-free. If you detach from the controlling terminal, the process structure now has a dangling pointer in it. This is pretty important, though I’m curious whether it can be a jail escape, since the jail is stored elsewhere in the process structure (I presume not). I think this code has been around for a while and it’s very much a ‘that’s what happens if you write C’ kind of bug. Newer languages give you tools for avoiding this kind of thing by construction. The other bug is in page-table handling for MPK. This is a pretty useless CPU feature. You can use it (in combination with the landing-pads feature and some binary patching) to build a fairly efficient sandbox, but it’s Intel making a bad copy of an AArch32 feature. A bit embarrassing that whoever did this didn’t understand how x86 page tables work. Again, this is the kind of thing that happens when every part of a system needs to understand the data structures it’s modifying. Apple rewrote their pmap in C++ a few years ago and this would not have been possible in their model because the page-table manipulation code would have gone through something that understands superpages.