はじめに 版番号が上がっても、その番号が指す中身が自分の環境に入っているとは限りません。今回の5本は、どれも「見えている部分」と「見えていない部分」のずれの話として読めます。Alpine Linux の GitLab は、版を上げても、修正が入っていない Ruby のまま動いていました。Fedora 45 は判定会議を通りましたが、確認時点では出荷前です。Linux 7.2 系は 7.2.15 で更新が止まり、そこに入った skb_zerocopy の修正は、番号の新しい 7.3.1 のコミットの件名には見当たりません。Langflow は修正版が先に出ていて、あとから CVE が公開されました。LXD は、証明書の鎖のうち、先頭の1枚しか鍵の所有を証明していませんでした。\n

A few weeks ago, Copycat sent me an email asking if I knew anything about the TNT warez group macOS cracks. They were worried that the cracks could be used to leverage malware since TNT is (?) Russia based. Cyber war is real and this could be an interesting case to look at. These cracks are based on a dynamic library injection, with obfuscated code and anti-debugging measures. This of course triggered my curiosity since the usual anti-anti-debugging measures (ptrace & friends) weren’t working. Even more interesting, one of the cracked apps had pro-Ukraine related content that was modified, so it was a perfect target for malware. Even if malware free, what was behind the obfuscation and anti-debugging?

By pico — from the 0x00sec forum

Disassembler, decompiler and ptrace debugger with a built-in MCP server (CLI)

Before users can interact with computer software, its source code must be converted into executable binaries and software packages, a task handled by specialized tools known as build systems.

strace -p gets EPERM on the server and works in a container on the Mac. Yama's rule is lineage, not 'child'; /proc/pid/mem to pidfd_getfd share one gate. Leaks: userns, setcap, PR_SET_PTRACER.

strace -p sunucuda EPERM, Mac'teki konteynerde çalışıyor. Yama'nın kuralı 'çocuk' değil 'soy'; /proc/pid/mem'den pidfd_getfd'ye aynı kapı. Kaçaklar: userns, setcap, PR_SET_PTRACER.

Records every process and file access in a build and shows it as an interactive timeline - LalitMaganti/buildprof

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.

Just because you have the ability to access a resource does not mean you should. * Programs don't write into random files on your filesystem, that would be data corruption. * Programs don't randomly attach ptrace (debugging) probes onto random processes and inject memory writes, that would be data corruption. * And libraries don't randomly poke fds they don't own, that would be data corruption. IO-Safety discipline is aimed to codify _that_. It does not aim to prevent intentional calls to `try_clone` on resources you properly have obtained ownership of. If you have a resource where `try_clone` would be inappropriate then move that `OwnedFd` into an opaque wrapper as soon as you have obtained it and then nothing which obeys IO-safety will touch that FD. See Does rust abstract file operations incorrectly? - #5 by the8472 for how to do that on inherited FDs.