Latest activity
-
Ddw-cj replied to the thread KVM NX huge page recovery burns a core per guest on kernel 7.0.x.windows or linux guests? does guest OS / workload matter?
-
ZZnuff reacted to asdpiasdjoi's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with
Like.
Found it. It is a complete compromise of the web interface. No pre-requisites, just a vulnerable proxmox version. There was a bug patched in pve-access-control (potentially by accident) in 2023. I will submit it to MITRE so a CVE can be issued... -
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Found it. It is a complete compromise of the web interface. No pre-requisites, just a vulnerable proxmox version. There was a bug patched in pve-access-control (potentially by accident) in 2023. I will submit it to MITRE so a CVE can be issued...
-
ZZnuff replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.22/8006 This is 100% an auth bypass on 8006. Else I don't see why the attackers would just straight up use the "Shell" function of the Web Interface as the first thing they did -- I confirmed this by timestamps, all files I found so far were...
-
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.What ports were open to the internet on the machine? Only 22/8006 or everything?
-
ZZnuff replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Nothing relevant in all of these. They have also cleaned the systemd journals. There's also a service for the miner being installed, using libhide: # systemctl cat PVE-1 # /etc/systemd/system/PVE-1.service # Managed-by: install_and_mine.sh...
-
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.grep -h "successful auth for user" /var/log/daemon.log* /var/log/syslog* 2>/dev/null grep -h "authentication failure; rhost=" /var/log/daemon.log* /var/log/syslog* 2>/dev/null journalctl -u pveproxy -u pvedaemon --since "-30d" | grep -iE...
-
Cchristianio replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.our hope means on @kore right now.
-
ZZnuff replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.No, the file with the access/breach was deleted
-
Ttsohr reacted to topkung1's post in the thread VM freeze on kernel 7.0.x (7.0.6 → 7.0.14) — vCPUs stuck in KVM_RUN, recovers instantly on ptrace attach — stable on 7.0.2 with Like.
Hi all, After the kernel moved from the 7.0.2 base to 7.0.6-2-pve, my Windows VMs intermittently freeze and only a hard reset recovers them. The 7.0.2 base (the PVE 9.2 default) has been stable. I am currently pinned back to 7.0.2-7-pve and...
-
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Anything in /var/log/pveproxy/access.log ?
-
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.That's a crypto miner. Seems this 0-day is being abused by multiple parties - one ransomware, one to mine crypto. I have a few LLMs working on the codebase with these facts, hopefully we have some answers in a few hours.
-
ZZnuff replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Can confirm, found 3 instances of 7.4.20 pwned. Few things: Attacker drops a payload in `/var/lib/systemd/PVE-1` Binary runs...
-
-
IIvan The Geek replied to the thread [SOLVED] Heads-up: newly-granted PBS ACLs are cached up to 5s — scripted PVE storage adds need a retry, not a sleep.Thank you - that explains it, and it corrects my number, which is worth stating plainly for anyone who finds this thread by searching the error string. I reported ~1 s. It is up to 5 seconds. A single probe measures where it landed inside the...
-
IIvan The Geek replied to the thread [SOLVED] small LXC + tmpfs + journald with defaults => LXC die with OutOfMemory.Adding to a solved thread only because Debian 13 has widened this, and because your third question - "is there a way to manage it globally, without taking care about journald config in each LXC?" - now has a general answer. Cap the tmpfs itself...
-
IIvan The Geek replied to the thread PVE9.x Debian13 LXC /tmp.For anyone finding this thread later: this is tracked at Bugzilla #6167 (open, UNDECIDED), where I have added measurements across ten containers. Two things worth adding here. First, on Fabian's "you need to do that manually per tmpfs instance"...
-
Cchristianio reacted to asdpiasdjoi's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
If you share details, even which endpoint is affected, people can prepare a patch or other measures. If you don't, these hackers will keep ransomware machines anyway. Anyone can put a bait proxmox 7 server on the internet and collect the logs...
-
IIvan The Geek posted the thread LXC freezes, ssh 'banner exchange' timeout, high load idle CPU — Debian 13 /tmp tmpfs uses host RAM in Proxmox VE: Installation and configuration.Posting this because the existing threads on this are all titled by the cause ("tmpfs wrong size"), and nobody hitting it searches for that. They search the symptoms - and those searches currently return threads about slow storage and HA...
-
JJohannes S reacted to leesteken's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
This is both irresponsible and to be expected. Someone should warn then against doing this. This is helpful (for people running outdated versions). There have been several SSH vulnerabilities in the (internet) news. People should know better or...
-
JJohannes S reacted to rodrigonb's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Well, if that makes any difference (I'm not a troll and have been registered for years): * I had a few bare metal customers with publicly accessible proxmox 7.2 URLs that were hacked; * Same message as these other users (ramsomware note) * No...
