this post was submitted on 30 Apr 2026
233 points (98.7% liked)

Selfhosted

58887 readers
835 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] JelleWho@lemmy.world 35 points 2 days ago (2 children)

For a second I though this was something bad for my computer. But is mainly a server permissions issue it seems. Will patch my server when I'm home though

[–] bookmeat@fedinsfw.app 24 points 1 day ago (1 children)

It affects any device that can use raw sockets in the kernel. Patch everything.

[–] JelleWho@lemmy.world 6 points 1 day ago

"mainly", it is a 'lower' priority for single use local computers

[–] drkt@scribe.disroot.org 8 points 1 day ago (3 children)

What do you mean? If you use Linux on your computer, it's also relevant. Any program can quietly drop a root shell from any privilege level in 10 lines of python.

[–] ipp0@sopuli.xyz 27 points 1 day ago (1 children)

This attack must be run locally. The attacker must already have user access. They can then escalate privileges using this. Meaning your box must already be compromised for this to work. Still serious, but no need to panic in most cases.

[–] possiblylinux127@lemmy.zip 6 points 1 day ago (1 children)

A local compromise happens more than you think

[–] ipp0@sopuli.xyz 2 points 22 hours ago (1 children)

Do you have a source for how often it happens or is this conjecture? I guess this would most often happen through supply chain attacks or physical access, the first not being all that common in my understanding and the latter not being a typical threat model for a home computer. But if you have a source explaining what actually happens, I would love to read it.

[–] possiblylinux127@lemmy.zip 1 points 18 hours ago* (last edited 18 hours ago)

There are plenty of way to get a local unprivileged shell

For instance, if you are running a old version of cups someone could chain together several vulnerabilities to gain root on your system

https://www.bleepingcomputer.com/news/security/cups-flaws-enable-linux-remote-code-execution-but-theres-a-catch/

Having a MAC like SELinux helps to mitigate this but you still should patch as soon as possible

[–] s38b35M5@lemmy.world 5 points 1 day ago (1 children)
[–] drkt@scribe.disroot.org 7 points 1 day ago (1 children)

/c/selfhosted moment

Sure don't patch a quiet and easy root shell escalation because it is, by itself, not a remote exploit. I sure do hope you trust every single piece of software running on your computer.

[–] thesmokingman@programming.dev 10 points 1 day ago

I think you’re displaying a very big gap between understanding risk assessment and understanding task completion. So far I have not seen anyone say they would not complete the task. I have seen people complete risk assessment. Risk assessment does not mean I will not do something, it just reflects the urgency with which I will do it. Most self-hosted users can safely apply basic risk assessment to see, while the impact may be high, the likelihood is low. Obviously the likelihood increases the more hands off you are with, say, unattended container updates for things that can escape containers or access the underlying system. Should most self-hosted users literally drop everything, rush home, and apply the patch? No, basic risk assessment does not merit that. Should everyone apply the patch? Yes.