themachinestops@lemmy.dbzer0.com to Technology@lemmy.worldEnglish · 3 days agoAI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugsthehackernews.comexternal-linkmessage-square39fedilinkarrow-up1150arrow-down128
arrow-up1122arrow-down1external-linkAI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugsthehackernews.comthemachinestops@lemmy.dbzer0.com to Technology@lemmy.worldEnglish · 3 days agomessage-square39fedilink
minus-squaregreyscale@lemmy.grey.ooolinkfedilinkEnglisharrow-up9arrow-down5·3 days agoDoes nobody isolate ffmpeg and friends from their application? I can’t imagine you’d have much fun breaking into a container that terminates the moment the original ffmpeg stops, or over-runs its max execution time…
minus-square[object Object]@lemmy.calinkfedilinkEnglisharrow-up22arrow-down1·3 days agoContainer escapes do exist, and they have shared kernel with the host
minus-squarePasserby6497@lemmy.worldlinkfedilinkEnglisharrow-up5·3 days agoIf you’re running rootless containers, it’s less of a concern. I’m trying to move all of my public containers to podman for this reason
minus-squareVibeSurgeon@piefed.sociallinkfedilinkEnglisharrow-up1·3 days agoSure, you’d need a second exploit to escalate from there. ffmpeg is expected to run for extended periods of time, given its use in transcoding.
Does nobody isolate ffmpeg and friends from their application?
I can’t imagine you’d have much fun breaking into a container that terminates the moment the original ffmpeg stops, or over-runs its max execution time…
Container escapes do exist, and they have shared kernel with the host
If you’re running rootless containers, it’s less of a concern. I’m trying to move all of my public containers to podman for this reason
Sure, you’d need a second exploit to escalate from there.
ffmpeg is expected to run for extended periods of time, given its use in transcoding.