A community for PC Master Race.
Rules:
Non Tom's slopware original:
https://github.com/V4bel/dirtyfrag
Also nice lies and panic spreading by them:
that's currently setting the Linux server world on fire
The vulnerability requires local user access to the affected system which is already a gigantic security hole if that's the case on a server...
It's a big problem for multi-user servers where some users aren't supposed to have root access. For example, my university has several student-accessible servers, and they all seem to be currently vulnerable to the exploit. A malicious student could cause quite a lot of damage.
No patches available!
Literally a mitigation section on the page.
"No patches available" might've been true at time of writing (and might still be true for old kernels, idk), but kernel 7.0.4, released yesterday, is already fixed.
That article doesn't tell me much. Any writeup with the affected code?
Edit: found it
https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md
NICE! Linux has made it everyone!
It bothers me that the test for this vulnerability is a link to some random repo online with arbitrary code and no one is batting an eye.
At least it presents code instead of sooperhax.exe
Also @iopq@lemmy.world linked the explanation in the repo : https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md
Admittedly I just gave it a quick scan for now though.
What is the exploit case? It says it's IPsec stuff?
Is it therefore remotely exploitable, or does it need a local user?
Are routers at risk?
"any local user can instantly get root (administrator) access on an affected box, just by running a small program" quote from the short article. So it seems home computers are safe.
I thought that was refering to copyfail?
It's gotta be local.
Also local, right?
People don't realize how easy it is to get local access.
There's a very good reason you should not run your browser as root.
This and the others will probably be fixed as fast as usual, and the NSA, the CIA, and their Chinese, Russian, and whatever counterparts will have one less exploit in their arsenals.
