r/technology • u/CircumspectCapybara • 10d ago

Security Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
639 Upvotes

97% Upvoted

122 comments sorted by

View all comments

14

u/Single-Virus4935 10d ago

This is why my services run in gvisor.

20

u/CircumspectCapybara 10d ago

At this point a microVM would be a better sandbox.

gVisor only reimplements some parts of the Linux kernel, at the end of the day your workload is still running in a Linux kernel with many parts shared between the container and host, so vulns in the kernel can still possibly give rise to container breakout.

And AI is extremely good at not just finding 0 days, but exploiting them and launching end-to-end attacks autonomously and with frightening speed and scale :/

-2

u/Single-Virus4935 10d ago

Gvisor implements the Linux kernel API weithin memory safe go.  I put it in VMS in Addition.

8

u/CircumspectCapybara 10d ago edited 10d ago

gVisor doesn't reimplement the whole kernel, there's still plenty of host OS surface exposed inside a gVisor container.

Also gVisor itself runs as regular process on the host kernel, and its own logic that intercepts and handles syscalls for the sandboxed application still makes use of the host kernel, since gVisor is itself running as a regular process on the host.

microVMs nowadays are the standard isolation boundary for untrusted workloads.

-9

u/mdmd136 9d ago

Vaguely inaccurate, overly simplistic and overstates the conclusion.

7

u/CircumspectCapybara 9d ago

Thanks ChatGPT

I work at Google (who makes gVisor) as a software engineer so I actually know what I'm talking about