• narc0tic_bird@lemm.ee
    link
    fedilink
    arrow-up
    48
    ·
    3 months ago

    Let’s see if this really affects all Linux systems or if the stars need to align for this to actually be exploitable.

    • FangedWyvern42@lemmy.world
      link
      fedilink
      arrow-up
      12
      ·
      3 months ago

      I still remember hearing about a Ring 0 exploit in Windows (I may be misremembering, though) that required Ring 0 access. I think if an attacker has access to Ring 0, you’re already screwed anyway.

    • ShortN0te@lemmy.ml
      link
      fedilink
      arrow-up
      12
      arrow-down
      1
      ·
      3 months ago

      I agree, all this attention grabbing sound to me as if this is actually not a big deal. But we will see i guess.

    • Possibly linux@lemmy.zip
      link
      fedilink
      English
      arrow-up
      10
      ·
      3 months ago

      A 9.9 is pretty bad no matter what. They wouldn’t rank it almost a 10 if it was some obscure bug that is very hard to exploit.

      With that being said it is hard to know without details

    • Treasure@feddit.orgOP
      link
      fedilink
      arrow-up
      23
      ·
      3 months ago

      This link should be working.

      Quoting from the OP tweet:

      * Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago.
      * Full disclosure happening in less than 2 weeks (as agreed with devs).
      * Still no CVE assigned (there should be at least 3, possibly 4, ideally 6).
      * Still no working fix.
      * Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot.
      * Devs are still arguing about whether or not some of the issues have a security impact.

      I’ve spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can’t accept that their code is crap - responsible disclosure: no more.

  • Laser@feddit.org
    link
    fedilink
    arrow-up
    16
    arrow-down
    1
    ·
    3 months ago

    Since this affects Linux and others, I’m guessing this is about OpenSSH. But I’m not very certain. Just can’t think of another candidate.

    But holy sh, if your software has been running on everything for the last 20 years

    This doesn’t sound like glibc as someone in the thread guessed.

    • Strit@lemmy.linuxuserspace.show
      link
      fedilink
      arrow-up
      7
      ·
      3 months ago

      Could be quite a few different things.

      Could be the kernel itself, gnupg, openSSH or even bash.

      But we won’t know for sure, until it’s publically disclosed.

      • Laser@feddit.org
        link
        fedilink
        arrow-up
        7
        ·
        3 months ago

        Could be the kernel itself

        Wouldn’t make sense to me because the thread says GNU/Linux and others, though this could relate to Android or distros not using any GNU.

        gnupg

        Usually not exposed to the network though, but it’s generally a mess so wouldn’t be too surprising

        Another candidate I have in mind is ntpd, but again that is usually not easily accessible from outside and not used everywhere, as stuff like systemd-timesyncd exists.

        Just want to stress that I’m not sure about it being OpenSSH, it was more supposed to be a fun guess than a certain prediction

  • nyan@sh.itjust.works
    link
    fedilink
    arrow-up
    12
    ·
    3 months ago

    I can’t think of anything except the kernel that is genuinely obligatory on all Linux systems, including embedded. Not glibc (musl). Not udev (mdev). Not systemd (OpenRC/runit/etc). My guess is that this is another exploit of something the reporter hasn’t realized isn’t mandatory because they’re not familiar with non-mainstream distros. I suppose it could be a kernel issue that Android has specifically patched, but if that’s it it’ll be fixed in short order.

    In other words, not exactly holding my breath.

    • corsicanguppy@lemmy.ca
      link
      fedilink
      English
      arrow-up
      3
      ·
      3 months ago

      If it’s only GNU Linux - and not regular Linux - then we know it’s not the Linux where the issue occurs. ;-)

      (Just analyzing what’s said. It’s probably all linuxes if it’s not a glibc issue)

    • communism@lemmy.ml
      link
      fedilink
      arrow-up
      1
      ·
      3 months ago

      It says GNU/Linux but also says “and others” which could mean anything. eg doesnt specify if something like Alpine would be affected—is that “and others”?

      In any case, I’ll wait 2 weeks and find out.

    • MigratingtoLemmy@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      3 months ago

      10/10 that poor bloke from Intel who copy-pasted code without understanding it (and got an earful for it) had buffer overflow bugs in his bit of plagiarized oeuvre

  • Karna@lemmy.ml
    link
    fedilink
    arrow-up
    8
    ·
    3 months ago

    More important question is - how this nitter instance is still working!!

    • steeznson@lemmy.world
      link
      fedilink
      arrow-up
      5
      ·
      3 months ago

      I believe if the instance is still up then it will still work up until a daily limit is reached. Most of them appear to be broken because the limit is fairly low.

    • Treasure@feddit.orgOP
      link
      fedilink
      arrow-up
      2
      ·
      2 months ago

      Yeah, what a disappointment. This guy brought shame to the security community because he was salty that his vulnerability didn’t get the attention it “deserved”.

      • deafboy@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        Disappointment? Only if you mean the person that came up with FoomaticRIP.

        For those who did not read the entire thing, it’s a so called “filter” that converts the document before it’s sent to certain nasty types of printers. Except it’s not executed on the print server. The unauthenticated print server can just ask a client to run it on their side. And it’s designed to be able to execute ANY command.

      • MigratingtoLemmy@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        That was a bit sarcastic, but my Linux servers are indeed disconnected. I’d create my personal mirror (preferably on BSD and update from there). Now that the cat is out of the bag though, I feel stupid. Really, for CUPS??? Are you kidding me???