FabricScape: Microsoft warns of vuln in Service Fabric

Microsoft is flagging up a security hole in its Service Fabric technology when using containerized Linux workloads, and urged customers to upgrade their clusters to the most recent release. The flaw is tracked as CVE-2022-30137, an elevation-of-privilege vulnerability in Microsoft's Service Fabric. An attacker would need read/ …

[Pascal Monett]

"Windows has been thoroughly vetted"

Oh really ?

You don't say. By who ?

Maybe you get some of those guys to thoroughly vet your updates as well ?

Silly me, I need some more frog pills . . .

[ITMA]

Re: "Windows has been thoroughly vetted"

The Vet - Windows 11 has been well and truly neutered.

[Wellyboot]

Re: "Windows has been thoroughly vetted"

>>>"By design," said Microsoft, "root access on the machine hosting the SF note is not considered a security boundary in an SF cluster; the highest privileged role on a node is equally privileged anywhere in the same cluster."<<<

By design root access is not a security boundary ! - MS harking back to DOS then...

[Lars]

Is Microsoft in the process of giving Linux a bad reputation among MS users.

[Anonymous Coward]

What?

This is an issue with Microsoft's Service Fabric, but it's Linux's fault because a process running in Linux can escape and take over the Service Fabric cluster. Maybe Service Fabric server should control what processes can access, not the guest.

[ElReg!comments!Pierre]

Re: What?

My thought exactly. It's a Linux issue because Windows doesn't allow you to do much so you can't exploit this Microsoft bug from Windows...

- Embrace : Check, Linux on Azure

- Extend : not an issue in a Cloud, it's more like "Empower" there (still an "E" so in-spec)

- Extinguish : Let's artificially create security bugs on our platform that are only exploitable from the competition's guest, then claim it's the guest's fault.

[gerryg]

Re: What?

At best it's an admin issue.

Execute privileges are required to exploit this vulnerability. Once you have given away execute privileges you have given away everything.

That's why users don't get execute privileges.

There's a reason 666 is the number of the beast

[ElReg!comments!Pierre]

Re: What?

"That's why users don't get execute privileges.

There's a reason 666 is the number of the beast"

666 is the number of the beast because it gives me the privilege to execute users who demand it. Or did I get that wrong all that time ?

[Anonymous Coward]

Re: What?

Except on Windows which has proper constrained delegation so execute can still be restricted as to what it can do.

[Anonymous Coward]

Re: What?

OTOH, I would be significantly less pleased if M$ inmposed its Windoze restrictions on Linux.

[Anonymous Coward]

Re: What?

And fixed its security you mean? Such that you can delegate rights granularly and SUDO doesn't need root privileges.

[ElReg!comments!Pierre]

Re: What?

"Such that you can delegate rights granularly and SUDO doesn't need root privileges."

Can you elaborate on that ? because that's someting *Nix has been doing for a few decades now, and that MS just figured they might try to emulate, like, last year or so. And they spectacularly failed.