this post was submitted on 19 Jun 2025
52 points (94.8% liked)

Linux

8249 readers
322 users here now

A community for everything relating to the GNU/Linux operating system

Also check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
52
New Linux Flaws Enable Full Root Access via PAM and Udisks Across Major Distributions (thehackernews.com)
submitted 2 weeks ago by ikidd@lemmy.world to c/linux@programming.dev
6 comments fedilink hide all child comments
top 6 comments
sorted by: hot top controversial new old
[–] atrielienz@lemmy.world 4 points 2 weeks ago (2 children)

Would implementing something like this prevent this problem?

https://discussion.fedoraproject.org/t/securing-fedora-with-fido2-utrust-full-disk-luks-gui-login-and-sudo-authentication/154136

[–] dgdft@lemmy.world 9 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

That is a setup guide for hardware key and passkey auth. It is not a hardening guide, and does nothing to mitigate these LPE vulns.

[–] atrielienz@lemmy.world 7 points 2 weeks ago

Thank you. That's what I wanted to know.

[–] TeNppa@sopuli.xyz 2 points 2 weeks ago (1 children)

This is said in the article:

To mitigate the risk posed by these flaws, it's essential to apply patches provided by the Linux distribution vendors. As temporary workarounds, users can modify the Polkit rule for "org.freedesktop.udisks2.modify-device" to require administrator authentication ("auth_admin").

[–] N0x0n@lemmy.ml 4 points 2 weeks ago* (last edited 2 weeks ago)

Yeah... Can you tell me where to change this? This article is not very clear, who, where or what... I'm running headless Debian 12 and can't even find any variable related to org.freedesktop.udisks2.modify-device or any polkit rule in /etc/polkit-1/rules.d/.... and not even a PolicyKit package installed on my system (polkit?)...

The only thing that comes close is /usr/share/polkit-1/...

Edit:

I guess this is a wrong assumption:

udisks ships by default on almost all Linux distributions

udisks2 is not even installed by default on my debian 12 system.

[–] Fizz@lemmy.nz 2 points 2 weeks ago

Oof massive cve. It was disclosed so I'm assuming its already patched?