GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

https://nebusec.ai/research/ionstack-part-2/

by ranger_danger • 15 days ago

417 182 15 days ago

nebusec.ai

UAF = Use After Free (https://en.wikipedia.org/wiki/Dangling_pointer)

mixmastamyk• 13 days ago

A what?

happymellon• 13 days ago

Use after free?

dang8• 11 days ago

Thanks! I've put that in the toptext now.

teo_zero• 12 days ago

I'm glad someone else asked. :)

It's not so widely used and it's not explained in the first couple screenfuls of TFA (which by itself is weirdly structured, taking entire paragraphs to explain when it was introduced, when it was discovered, etc. before even explaining what it actually is).

Of course the title was chosen when the article was first published on a site dedicated to security, where probably everyone knows it. This suggests that insisting on unmodified titles when republishing in HN is a poor rule.

lkirkwood• 12 days ago

Not that everyone should know it but it's definitely widely used. A Google search for "stack UAF" also turns it up.

didntcheck2• 10 days ago

Unidentified Aerial Fenomenom

teleforce• 13 days ago

Google has rewarded us $92,337 in kernelCTF

I'm all ears now

mrbluecoat• 13 days ago

Seems low considering the wide impact, but maybe the only thing corporations throw big money at is remote exploits?

tptacek2• 12 days ago

That's a huge amount of money for a vulnerability.

ActorNightly4• 10 days ago

How is it a wide impact?

It requires being able to execute arbitrary code on the machine in userspace. If you have that, most of the time you don't even care about kernel level exploits.

password43214• 13 days ago

Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.

circularfoyers2• 13 days ago

Since this enables container escape, sounds like this might still impact quite a lot of us?

hollerith• 12 days ago

A lot of us rely on Linux containers' being escape-proof?

I would have hoped that only a few of us are so misinformed as to do that.

password43214• 12 days ago

I guess, if you thought Docker/etc. was a security boundary

ActorNightly4• 10 days ago

If you run critical containers under Linux instead of a dedicated hypervisor, you deserve to get hacked.

Chu4eeno2• 12 days ago

they also found a type confusion in firefox/ionmonkey, so you can go from random website to pwned very quickly.

jurf• 10 days ago

Got me confused for a sec, as the exploit in the top comment implies JavaScript→root, but it actually relies on two separate exploits.

phire• 10 days ago

Not really. Generally we use "Local Privilege Exploit" to describe an exploit that goes from a reasonably normal user privileges to root privileges.

And we don't usually worry about them, because an application with normal user privileges can already to so much damage.

But this exploit can be triggered from inside a tightly sandboxed process, such as firefox's isolated browser process. Which means the attacker now only needs to chain two exploits together: One javascript exploit to get local code execution in an isolated sandbox, and this one to jump all the rest of the way to kernel mode.

Which means, you should update both firefox, and your linux kernel.

password43214• 10 days ago

this exploit can be triggered from inside a tightly sandboxed process

Thank you for emphasizing this important detail.

you should update both firefox, and your linux kernel

No doubt, update all the things! My point was, it can most likely wait until Monday.

franga2000• 10 days ago

Realistically, if you have a browser sandbox, the system LPE exploit gives you very little more. Everything interesting on a desktop system is accessible by the user account directly.

iririririr• 10 days ago

as if in these times there aren't hundreds of "0days" in everyone's hands waiting to be burned for situations just like this.

from ssh to node, so much stuff showing every other week. might as well call everything remote unless you run 100% behind wireguard or something.

pixl97• 10 days ago

Pretty much, the rate at which quality exploits are dropping is mind blowing.

amatecha• 13 days ago

Daaaaamn: "GhostLock was introduced in Linux 2.6.39 and fixed in Linux 7.1."

goodburb4• 12 days ago

Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older).

Two boot looped, I had to enter recovery and the other just powered off [0].

The demo modifies the wallpaper on supported Pixel devices.

[0] IonStack https://rootme.nebusec.ai

____

Tip: Install a Chromium flavor browser (Chromite) separate from the main browser.

Disable Javascript and hardware accelerated video decoder (commonly exploited) from the flags page and enable reader mode to fix broken JS-dependent websites when browsing blogs and random sites on your personal devices, else dedicate a tablet.

Chu4eeno2• 12 days ago

fwiw, the firefox vulnerability seems to be CVE-2026-10702 (type confusion in the ionmonkey jit compiler): https://www.sentinelone.com/vulnerability-database/cve-2026-...

no_time• 10 days ago

Severity score of 4.3 seems low considering the click2pwn in this thread. Though Firefox on Android is uniquely bad because of the lack of sandboxing.

etenal4• 11 days ago

Thanks for testing, we currently only tested it on Pixel 10, but there are a few people on our repo creating PR to support other devices, you can take a look here https://github.com/NebuSec/CyberMeowfia

bana-io4• 10 days ago

Can you please provide a `Dockerfile` to build the POC/exploit?

Retr0id• 11 days ago

I've been noodling with porting the kernel exploit to other devices, and the exploit is very sensitive to how the compiler happens to lay out stack frames, which varies between kernel builds. Once you figure out the right "stamp method" and offsets for a particular kernel build though, it's fairly reliable.

coffe2mug• 10 days ago

Would be amazing if this was used to root so-far unrootable android devices. Any suggestions.

mschuster912• 10 days ago

Wonder if it were possible to use this to (finally) jailbreak DJIs original RC that came with the Mini 3 Pro.

It doesn't have a web browser or, virtually, anything of use... but I think it supports enough of a web browser to log in into wifi captive portals.

bana-io4• 10 days ago

What Android devices did you test on exactly?

I take it you did NOT unlock the bootloader?

Two boot looped, I had to enter recovery and the other just powered off [0].

Absolutely crazy that it is possible to brick someone's phone via an exploit but ... hey.

After the power off what happened? Do things seem normal?

When it entered recovery mode where you able to get the phone in a clean state again? I take it that you did?

I'd really like to run this but I, ideally, do not want to run something random from the internet. It's a shame there is no `Dockerfile` to build this exploit/POC. All I want is LPE to `root` on a Samsung (Snapdragon) phone.

goodburb4• 10 days ago

Originally tested on non personal devices

Honor 10 - Moto G04 - Poco X3

Poco is unlocked.

There is no brick on any, they're boot loader bugs and unrelated to the exploit. Recovery "reboot" was used.

You need to modify it to root, the example only crashes the kernel.

bana-io4• 10 days ago

So I took the risk and ran it on a Samsung S26 Ultra - I will confirm the full details once I have `adb` installed and running.

The exploit/POC (call it what you want) ran or appeared to have executed because:

1. I saw output on the Firefox tab when I navigated to <https://rootme.nebusec.io/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d...>.

2. I saw some output from the execution of the POC.

However, after I went to <https://rootme.nebusec.io/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d...> the phone froze and refused to respond to any input. The only thing that worked was restarting, which I wonder how it works given the, I think, the kernel has hung. Does anyone know how the kernel is able to respond to events whilst the system has hung? The screen remains on with the partial output of the execution of the POC until the screen saver kicks in ...

inigyou10• 10 days ago

The kernel is not a single-threaded process - a "kernel hang" is not a very specific description and you don't have a way to know that it happened anyway. The screen timing out is evidence that the kernel was largely working, actually. Of course if some data structure got corrupted it could have affected a specific essential part of the system, such as the touchscreen driver or the display compositor.

guilhas• 9 days ago

Pixel 7, nothing happens

It takes a few seconds, and redirects to about:blank

Android 13, last update 3 years ago, firefox 140

Maybe prevented by the JShelter extension?

https://addons.mozilla.org/en-US/firefox/addon/javascript-re...

Uptrenda• 11 days ago

Has anyone in infosec ever seen the term "use after free" before LLMs? Or is this basically an acronym claude invented? I say this because I see claude use this term all the time like its common knowledge but in 15+ years in tech never seen it myself. I've seen all kinds of terms used to describe memory errors: memory corruption, heap corruption, stack corruption, whatever, just never this acronym.

paulv• 11 days ago

It has been a known bug class for quite some time.

michaellee8• 11 days ago

if you have spend any amount of time in low level c vulnerabilities you will have heard about it, it is a very common time on the low level/cybersec space.

mdkotlik• 11 days ago

yes, it’s a very common term in infosec. I haven’t heard the “UAF” acronym before though

smcameron• 10 days ago

I've heard of use after free, but I've only heard UAF to mean Ukraine Armed Forces.

LPisGood• 11 days ago

Yes, it was a common attack vector in binary exploitation. Heap based attack vector like use after free, double free, heap overflows, and others are pretty neat. They force you to learn a lot about how malloc works.

There is a lot of cool work that went into making memory allocation work well; the different arenas, fast bins, chunk headers, etc. are super cool.

mirashii• 11 days ago

This is and has been a common term in any systems programming concept for decades. You can, for example, search CVEs and easily find some from over 15 years ago: https://www.cve.org/CVERecord?id=CVE-2010-1119

It was even enumerated in the first pass of CWE as CWE-416 in 2006.

Klonoar• 11 days ago

You have somehow lived in a strange bubble.

2025: https://redis.io/blog/security-advisory-cve-2025-49844/ 2023: https://seclists.org/oss-sec/2023/q2/133 2022: https://www.zerodayinitiative.com/advisories/ZDI-22-1690/ 2014: https://ftp.openbsd.org/pub/OpenBSD/patches/5.4/common/008_o...

It's an issue as old as time, or thereabouts.

asveikau• 11 days ago

I haven't really seen it as an acronym "UAF", but I can't recall the first time I heard "use after free". It was probably in the previous century.

The idea that Claude came up with it is ridiculous.

atoav• 11 days ago

Huh? That is a really common term. There have been even memes about it. I remember roughly 5 years ago I first heard the ironic; "Real men use after free" in a discussion about Rust's benefits as its borrowing checker would have also prevented this one.

"Use after free" is also described in most standard books about C as a thing you should never do, have you read one?

hgoel• 10 days ago

I'm surprised that UAF as an acronym is apparently unusual even among people familiar with use-after-free as a concept. I thought that was a pretty typical acronym in the context of software.

alexjplant2• 11 days ago

This is the same shape as many other life-cycle bugs [...]

Claude-ism detected. IME with Claude Code an object does not have a type or definition, apparently, but rather a shape (or at least it reaches for that word before more technically-accurate ones). Problems are not of a similar class or type, but of the same shape. Functions are not defined by their signatures but by their shape. Who talks like this and how did it make its way into the training data so pervasively?

dang8• 11 days ago

I think you're probably right that the article was AI-assisted, but (if so) it's important not to confuse that with the thing the article is about. Google wouldn't pay $90k for a hallucination.

I don't mean that as a criticism—the question of how to receive AI-processed content is chaotic right now. I'm working on a post about that here: https://news.ycombinator.com/item?id=48887149.

Btw, Nebula Sec is a YC startup in the current batch. We've been working with them on how to launch on HN, and one of the things I've been trying to explain is that the HN audience won't respond well to LLM-generated reports. The underlying work, though, is impressive. These guys know what they're doing—the OP is by no means their only significant find—and the fact that they're doing it with an agent, rather than the traditional way, is significant.

cwillu2• 11 days ago

A thing that notably triggers my allergies is that if significant human effort went into something, a few paragraphs written by a human seems like a trivial additional investment; if that last touch is missing, it's really hard for me to extend the benefit of the doubt that there really is something there.

Obviously this is only one signal among many, one that can be overruled, but the ick remains regardless.

a_t48• 10 days ago

You should put a note in Find a Cofounder not to do that as well. Huge turnoff for me, though I guess a great filter.

dmittman• 11 days ago

Isn't this just observation bias? "If I haven't encountered something, then it must not be real?" (Paraphrasing)

alexjplant2• 10 days ago

I must confess that I asked a leading question. At no point did I say that the usage wasn't real; by way of dramatic omission I was more pointing to the fact that a common ECMAScript/React-ism is overrepresented in Claude's training set to the point that it's being applied to situations not involving duck-typed languages.

I'm not a grammatical prescriptivist but I find it viscerally troubling that a bunch of LLM cargo-culted terms are starting to inform how we talk about our work.

etenal4• 11 days ago

We apologize for the confusion. We used AI to run final grammar pass and didn't noticed it changed some wording (shape is one of them). Will be more careful in the future

TurdF3rguson• 10 days ago

Except that working with Claude has me saying things like shape lately. I think I like it.

not-a-llm• 10 days ago

talking about data and function shapes is quite common in functional programming world

https://blog.jle.im/entry/functors-to-monads-a-story-of-shap...

sethammons• 10 days ago

When working in Elixir, everything is about the shape of things. I have now taken that word usage from that ecosystem because I find it useful.

marginalia_nu• 10 days ago

No this is normal programming terminology. Here I am using 'shape' in this sense back in 2021:

https://www.marginalia.nu/log/40-wasted-resources/

and even more similar usage again in 2023 'the shape of the algorithm' (which was post-claude I guess, but this was before I even tested any LLM):

https://www.marginalia.nu/log/87_absurd_success/

treyd2• 10 days ago

I've used phrasing like this from time to time before, like when trying to compare two ideas that are unalike but have some fuzzy similarities. I wouldn't use it to describe functions but "problems", "solutions", and other fuzzy things.

KnockOutEZ• 10 days ago

Damn

tangenter• 10 days ago

Fuck it. I’m exclusively running the book version of minix from now on, neovim be damned. The exploit surface of these kernels is wild.

KasianFranks• 10 days ago

So has the church of the subgenius.

0xbadcafebee• 10 days ago

Do we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend?

Also can we talk about how bad Linux security is? At this point it's becoming a real liability to run anything on Linux that needs to be secure. OpenBSD has been around for ages, is written in C, and is really, really secure. Do they support containers yet (or microVMs)? Cuz if they do, I'm moving my workloads to obsd.

close04• 10 days ago

Do we really need infosec companies now that a skid with claude can find decades-old kernel privesc over a weekend?

Why are you not making easy money hand over fist from these rewards? A couple of weekends of work and you can retire early.

Maybe that's exactly what these infosec companies are. And maybe you need more than "a skid with claude over a weekend" to get anything worthwhile.

_def• 10 days ago

and is really, really secure

... until its getting popular usage and gets targeted for vulnerability research

titularcomment4• 10 days ago

OpenBSD is the Linux of a decade or two ago, not attracting attention and not being compatible or useful for quite a lot of stuff.

NexRebular4• 10 days ago

Not counting GPU compute, what exactly is OpenBSD not useful for?

anthk4• 10 days ago

Just OpenSSH, nothing ;)

asimovDev• 10 days ago

TIL OpenBSD doesn't have jails

inigyou10• 10 days ago

Why didn't you find it with claude over a weekend?

NexRebular4• 10 days ago

Try illumos with zones. We run all critical services on SmartOS nowadays. Even linux bhyve VMs get confined inside a zone.

cyphar3• 10 days ago

If there was a similar class of bug in the illumos kernel, it would also allow for a container escape, no?

There are many issues with the formulation of containers on Linux (though I think people overstate it whenever bugs like this happen) but ultimately this bug was a UAF that gave you arbitrary code execution in the kernel. Zone IDs are also just numbers in kernel memory... right?

0x1ceb00da• 10 days ago

Does that mean any android app can use ndk native code execution to become root? Does selinux help here?

goodburb4• 10 days ago

Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely.

Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way.

Any compromised app on the Play store or external can get root access instantly, but we can still rely on trust and audits when installing apps which should always be the rule.

I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future.

That's not the case with browsers with random sites and ads which is hardly avoidable, having any sandbox escape is now more severe considering that it bypasses the app container. It's similar to JailbreakMe on iOS [0]

[0] https://en.wikipedia.org/wiki/JailbreakMe

kuschku5• 10 days ago

I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future.

You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity".

It's silly that whenever I see a vulnerability like this, all I can think about is "finally, a way to get control over my own devices back". Once again, Stallman was right.

https://www.gnu.org/philosophy/right-to-read.en.html

Personally, I'll use this to root my Android TV and Chromecast devices and remove the shitty ads in the launcher (which Google added after I bought the devices!).

ChocolateGod7• 10 days ago

Considering that it's rare to get kernel (or any) updates on non-flagship phones

How the cluster f*k of the Android update situation Google has allowed this to happen really needs a regulator to step in.

Planned obsolescence is supposed to be illegal in Europe.

jeroenhd• 10 days ago

selinux doesn't help when the kernel itself has been compromized like this. Sandboxes from Android and containerisation tools like Docker do not protect you against this exploit. The only feasible method of restriction is full virtualisation (assuming that if you use KVM, last week's CVE-2026-53359 patches are rolled out everywhere).

Any app that can run native code execution on any version of Linux in the past fifteen years can get root until kernel updates arrive on your devices.

poly2it2• 10 days ago

Is HN bugged? I swear I have read these comments the day prior, there is no way they are from within 10 hours?

tpetry• 10 days ago

Sometimes similar articles are merged into one. Including the comments.

dang8• 10 days ago

I don't know what "bugged" means but what you're seeing is probably an artifact of HN's re-upping system. We re-upped this thread and that relativized the timestamps on the previously existing comments (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...). Sorry for the confusion—I know it's weird but so far no one has come up with an alternative that is less confusing.

The reason I re-upped this post, btw, is that it was at the top of a list called "underwater" that we try to look at every day, which lists the most-upvoted posts that for whatever reason didn't happen to make the frontpage. This was at the top of that list.

poly2it2• 10 days ago

Ah, I didn't know actual post timestamps for comments are updated. That explains it, thank you!

philipwhiuk• 10 days ago

New 'lastSubmission' field for the post item. Show both if they're different. Then just update lastSubmission on re-up?

Messing with the displayed times people sent their comments is honestly akin to rewriting their answers.

bitwize• 10 days ago

"Nothing could have prevented this from happening," say users of only language where this happens

inigyou10• 10 days ago

Not true, it can also occur in C++, Zig, and assembly language.

uecker• 10 days ago

Or Rust, when not sticking exclusively to safe Rust, but this is not really possible in many systems programming scenarious.

anthk4• 10 days ago

Firefox it's written in Rust.

afdbcreid• 10 days ago

No it's not. Yes it contains a lot of Rust, but it's still mostly C++.

reorder9695• 10 days ago

Could this be used to unlock bootloaders on typically non unlockable phones? If so this could be one of the best things to happen to Android.

pkoiralap• 10 days ago

Huge kudos to the security researchers for 1, finding an exploit, and 2, unlike copyfail, excluding a zero-day ready-to-use LPE script that anyone could have used.

I tried using this for LPE on a Rocky9 for a couple of hours and thankfully couldn't get it to work. So that means unless you have quite some free time on your hand, or are extremely good at doing what you do, you can't actually use this to get LPE on enterprise distros.

anthk4• 10 days ago

A good think I use JS less browsers.

GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

Related Stories