Latest activity
-
IIsThisThingOn replied to the thread PBS ZFS disk speed thoughts option.Not sure, but is it maybe just the missing ' ? That could also be the case. I created the user on pbs, so that is why I am using that. I also just gave it full admin rights and deleted the user afterwards.
-
Ccomplexplaster27 replied to the thread VM Networking Performance with Mellanox Connect X-3.What driver are you using to run the Mellanox cards? For reference this is what I'm using in our production servers for ceph storage and I can't saturate the mesh network that way using the Debian Linux Firmware drivers, granted I can't tinker...
-
Ffhandika posted the thread Need Help: Proxmox VE 7.4-17 – Windows Server 2012 VM Fails to Boot in Proxmox VE: Installation and configuration.Hi everyone, I’m currently running Proxmox Virtual Environment (PVE) 7.4-17, and for the past two days I’ve been experiencing an issue with one of my Windows Server 2012 VMs. The VM sometimes starts successfully and I can briefly access...
-
-
Uurog reacted to asdpiasdjoi's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with
Like.
Found it. It is a complete compromise of the web interface. No pre-requisites, just a vulnerable proxmox version. There was a bug patched in pve-access-control (potentially by accident) in 2023. I will submit it to MITRE so a CVE can be issued... -
Uurog reacted to gfngfn256's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
At least we now know, why you "can't" release any details currently.
-
Ggfngfn256 replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.At least we now know, why you "can't" release any details currently.
-
Ggfngfn256 reacted to leesteken's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Sure, but who will put in the time to determine what CVE was used? Then we know for sure which versions are affected. Until then, up to date Proxmox appears to be safe.
-
Pphilkunz replied to the thread Install NUT directly on Proxmox VE and control guests from here.Short update, sorry for the long silence and missing communication. It has proven quite difficult to tame AI scrapers, which required us to block expensive operations from public access. Like the scrapers will fire in the thousands of db heavy...
-
Ddw-cj replied to the thread KVM NX huge page recovery burns a core per guest on kernel 7.0.x.windows or linux guests? does guest OS / workload matter?
-
ZZnuff reacted to asdpiasdjoi's post in the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth with Like.
Found it. It is a complete compromise of the web interface. No pre-requisites, just a vulnerable proxmox version. There was a bug patched in pve-access-control (potentially by accident) in 2023. I will submit it to MITRE so a CVE can be issued...
-
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Found it. It is a complete compromise of the web interface. No pre-requisites, just a vulnerable proxmox version. There was a bug patched in pve-access-control (potentially by accident) in 2023. I will submit it to MITRE so a CVE can be issued...
-
ZZnuff replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.22/8006 This is 100% an auth bypass on 8006. Else I don't see why the attackers would just straight up use the "Shell" function of the Web Interface as the first thing they did -- I confirmed this by timestamps, all files I found so far were...
-
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.What ports were open to the internet on the machine? Only 22/8006 or everything?
-
ZZnuff replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Nothing relevant in all of these. They have also cleaned the systemd journals. There's also a service for the miner being installed, using libhide: # systemctl cat PVE-1 # /etc/systemd/system/PVE-1.service # Managed-by: install_and_mine.sh...
-
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.grep -h "successful auth for user" /var/log/daemon.log* /var/log/syslog* 2>/dev/null grep -h "authentication failure; rhost=" /var/log/daemon.log* /var/log/syslog* 2>/dev/null journalctl -u pveproxy -u pvedaemon --since "-30d" | grep -iE...
-
Cchristianio replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.our hope means on @kore right now.
-
ZZnuff replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.No, the file with the access/breach was deleted
-
Ttsohr reacted to topkung1's post in the thread VM freeze on kernel 7.0.x (7.0.6 → 7.0.14) — vCPUs stuck in KVM_RUN, recovers instantly on ptrace attach — stable on 7.0.2 with Like.
Hi all, After the kernel moved from the 7.0.2 base to 7.0.6-2-pve, my Windows VMs intermittently freeze and only a hard reset recovers them. The 7.0.2 base (the PVE 9.2 default) has been stable. I am currently pinned back to 7.0.2-7-pve and...
-
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.Anything in /var/log/pveproxy/access.log ?
-
Aasdpiasdjoi replied to the thread Proxmox VE 7 is vulnerable to some type of 0day/RCE non auth.That's a crypto miner. Seems this 0-day is being abused by multiple parties - one ransomware, one to mine crypto. I have a few LLMs working on the codebase with these facts, hopefully we have some answers in a few hours.
