GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

130

rranger_danger 4 days ago 50 commentsRead Article on nebusec.ai

ES version is available. Content is displayed in original English for accuracy.

UAF = Use After Free (https://en.wikipedia.org/wiki/Dangling_pointer)

⚡ Community Insights

Discussion Sentiment

59% Positive

Analyzed from 1152 words in the discussion.

Discussion (50 Comments)Read Original on HackerNews

teleforce•2 days ago

>Google has rewarded us $92,337 in kernelCTF

I'm all ears now

mrbluecoat•2 days ago

Seems low considering the wide impact, but maybe the only thing corporations throw big money at is remote exploits?

tptacek•2 days ago

That's a huge amount of money for a vulnerability.

goodburb•2 days ago

Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older).

Two boot looped, I had to enter recovery and the other just powered off [0].

The demo modifies the wallpaper on supported Pixel devices.

[0] IonStack https://rootme.nebusec.ai

____

Tip: Install a Chromium flavor browser (Chromite) separate from the main browser.

Disable Javascript and hardware accelerated video decoder (commonly exploited) from the flags page and enable reader mode to fix broken JS-dependent websites when browsing blogs and random sites on your personal devices, else dedicate a tablet.

Retr0id•25 minutes ago

I've been noodling with porting the kernel exploit to other devices, and the exploit is very sensitive to how the compiler happens to lay out stack frames, which varies between kernel builds. Once you figure out the right "stamp method" and offsets for a particular kernel build though, it's fairly reliable.

etenal•about 1 hour ago

Thanks for testing, we currently only tested it on Pixel 10, but there are a few people on our repo creating PR to support other devices, you can take a look here https://github.com/NebuSec/CyberMeowfia

Chu4eeno•2 days ago

fwiw, the firefox vulnerability seems to be CVE-2026-10702 (type confusion in the ionmonkey jit compiler): https://www.sentinelone.com/vulnerability-database/cve-2026-...

amatecha•2 days ago

Daaaaamn: "GhostLock was introduced in Linux 2.6.39 and fixed in Linux 7.1."

Curtis_Guan•8 minutes ago

2.6.39? That's really going back a ways. It's great to hear that GhostLock is already fixed in 7.1.

password4321•2 days ago

Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.

circularfoyers•2 days ago

Since this enables container escape, sounds like this might still impact quite a lot of us?

password4321•1 day ago

I guess, if you thought Docker/etc. was a security boundary

insanitybit•7 minutes ago

They are a security boundary. The fact that you need a vulnerability to escape them is proof of that. They just don't have a particularly high cost of escape because reachable kernel vulnerabilities are so common.

markasoftware•about 1 hour ago

Runpod, digital ocean's gpu cloud, and at least a few others use Linux containers for isolation between tenants (look at Wiz's blog post about the nvidia container toolkit bug; digitalocean just puts everyone in a massive k8s cluster)

circularfoyers•43 minutes ago

I know there's a lot you can do in k8s to mitigate it, but I didn't think that prevented it outright.

hollerith•1 day ago

A lot of us rely on Linux containers' being escape-proof?

I would have hoped that only a few of us are so misinformed as to do that.

Chu4eeno•2 days ago

they also found a type confusion in firefox/ionmonkey, so you can go from random website to pwned very quickly.

alexjplant•about 1 hour ago

> This is the same shape as many other life-cycle bugs [...]

Claude-ism detected. IME with Claude Code an object does not have a type or definition, apparently, but rather a shape (or at least it reaches for that word before more technically-accurate ones). Problems are not of a similar class or type, but of the same shape. Functions are not defined by their signatures but by their shape. Who talks like this and how did it make its way into the training data so pervasively?

dang•43 minutes ago

I think you're probably right that the article was AI-assisted, but (if so) it's important not to confuse that property of the article with the thing the article is about. Google wouldn't pay $90k for a hallucination.

I don't mean that as a criticism—the question of how to receive AI-processed content is a huge one that is in a state of chaotic turbulence right now. I'm working on a post about that over here: https://news.ycombinator.com/item?id=48887149.

Btw, Nebula Sec is a YC startup in the current batch. We've been working with them on how to launch on HN, and one of the things I've been trying to explain is that the HN audience won't respond well to LLM-generated reports. The underlying work, though, is very impressive. These guys know what they're doing—the OP is by no means their only significant find—and the fact that they're doing it with an agent, rather than the traditional way, is significant.

cwillu•25 minutes ago

A thing that notably triggers my allergies is that if significant human effort went into something, a few paragraphs written by a human seems like a trivial additional investment; if that last touch is missing, it's really hard for me to extend the benefit of the doubt that there really is something there.

Obviously this is only one signal among many, one that can be overruled, but the ick remains regardless.

dmittman•9 minutes ago

Isn't this just observation bias? "If I haven't encountered something, then it must not be real?" (Paraphrasing)

mixmastamyk•2 days ago

A what?

happymellon•2 days ago

Use after free?

dang•about 2 hours ago

Thanks! I've put that in the toptext now.

teo_zero•2 days ago

I'm glad someone else asked. :)

It's not so widely used and it's not explained in the first couple screenfuls of TFA (which by itself is weirdly structured, taking entire paragraphs to explain when it was introduced, when it was discovered, etc. before even explaining what it actually is).

Of course the title was chosen when the article was first published on a site dedicated to security, where probably everyone knows it. This suggests that insisting on unmodified titles when republishing in HN is a poor rule.

lkirkwood•1 day ago

Not that everyone should know it but it's definitely widely used. A Google search for "stack UAF" also turns it up.

Uptrenda•about 1 hour ago

Has anyone in infosec ever seen the term "use after free" before LLMs? Or is this basically an acronym claude invented? I say this because I see claude use this term all the time like its common knowledge but in 15+ years in tech never seen it myself. I've seen all kinds of terms used to describe memory errors: memory corruption, heap corruption, stack corruption, whatever, just never this acronym.

mirashii•about 1 hour ago

This is and has been a common term in any systems programming concept for decades. You can, for example, search CVEs and easily find some from over 15 years ago: https://www.cve.org/CVERecord?id=CVE-2010-1119

It was even enumerated in the first pass of CWE as CWE-416 in 2006.

LPisGood•about 1 hour ago

Yes, it was a common attack vector in binary exploitation. Heap based attack vector like use after free, double free, heap overflows, and others are pretty neat. They force you to learn a lot about how malloc works.

There is a lot of cool work that went into making memory allocation work well; the different arenas, fast bins, chunk headers, etc. are super cool.

michaellee8•about 1 hour ago

if you have spend any amount of time in low level c vulnerabilities you will have heard about it, it is a very common time on the low level/cybersec space.

paulv•about 1 hour ago

It has been a known bug class for quite some time.

mdkotlik•about 1 hour ago

yes, it’s a very common term in infosec. I haven’t heard the “UAF” acronym before though

atoav•37 minutes ago

Huh? That is a really common term. There have been even memes about it. I remember roughly 5 years ago I first heard the ironic; "Real men use after free" in a discussion about Rust's benefits as its borrowing checker would have also prevented this one.

"Use after free" is also described in most standard books about C as a thing you should never do, have you read one?

asveikau•about 1 hour ago

I haven't really seen it as an acronym "UAF", but I can't recall the first time I heard "use after free". It was probably in the previous century.

The idea that Claude came up with it is ridiculous.

Klonoar•about 1 hour ago

You have somehow lived in a strange bubble.

2025: https://redis.io/blog/security-advisory-cve-2025-49844/ 2023: https://seclists.org/oss-sec/2023/q2/133 2022: https://www.zerodayinitiative.com/advisories/ZDI-22-1690/ 2014: https://ftp.openbsd.org/pub/OpenBSD/patches/5.4/common/008_o...

It's an issue as old as time, or thereabouts.

abofh•about 1 hour ago

[flagged]

dang•about 1 hour ago

Please don't be snarky or cross into putdowns or personal attack. We're all in (let's call it) the unlucky 10,000 about something. About most things actually.

https://news.ycombinator.com/newsguidelines.html

LastTrain•about 1 hour ago

There is an interesting episode of This American Life about how everyone, everyone, has weird gaps in their knowledge that eventually get filled in sometimes fun or humiliating ways. You have these too.

dang•about 1 hour ago

Wow, what is that episode? I haven't listened to TAL in probably more than a decade but it was great for a long time, and for all I know still is.

defrost•about 1 hour ago

I can see that you're old and that I'm older, but I fail to see the justification for being snarky about that.

  Please don't sneer, including at the rest of the community.

~ https://news.ycombinator.com/newsguidelines.html

abofh•about 1 hour ago

[flagged]

Uptrenda•about 1 hour ago

[flagged]

dang•about 1 hour ago

I understand the response (hence https://news.ycombinator.com/item?id=48887373) but please don't react by breaking the site guidelines yourself. That only makes things worse.

https://news.ycombinator.com/newsguidelines.html

abofh•about 1 hour ago

[flagged]