Surprise surprise...
> Surprise surprise...
About as surprising as seeing completely content-less anti-systemd comments like yours popping up, really.
Systemd v228 local root exploit
11–20 of 162 posts
Re: Systemd v228 local root exploit
#12v228 is too new for Debian stable. Unstable had a update on feb 11, 2016.
Ubuntu never ran with such early version, since their first uploaded version was 229.
Re: Systemd v228 local root exploit
#13Re: Systemd v228 local root exploit
#14yeah, awesome, i enjoy this systemD shit show. Linux is so doomed.
You're right. Ever since distros made systemd default, computers all over the world have been catching fire, exploding, shooting jets of lava from their headphone jacks. It's the end times
Re: Systemd v228 local root exploit
#15>We would like to see that systemd upstream retrieves CVE's themself for their own bugs, even if its believed that its just a local DoS. So not only they didn't notice this was exploitable, they also seem to think that a local DoS is not enough for a CVE or a public report. Excellent.
I'm not aware of server or desktop OS that isn't generally vulnerable to local DoS.
Re: Systemd v228 local root exploit
#16>We would like to see that systemd upstream retrieves CVE's themself for their own bugs, even if its believed that its just a local DoS. So not only they didn't notice this was exploitable, they also seem to think that a local DoS is not enough for a CVE or a public report. Excellent.
> they also seem to think that a local DoS is not enough for a CVE Some vendors do not consider local DoS as security issues. I tried to discuss these kind of issues in oss-security but even MITRE refused to assign a CVE.
If the system are not restricted by having quota on every computer resource its trivial for any local user to DoS the system. For the issue to be exploitable, you need to have restrictions in place and to my knowledge the only way to do so in the past was with seLinux. Today of course there is cgroup.
Re: Systemd v228 local root exploit
#17Earlier quoted context omitted.
It's not the logic of hammering my own fingers that is flawed, it is my choice of a hammer!
You can program touch() to create files with 0777 rights in any language, not just C.
Although the specific cause -- (mode_t)-1 -- is something that you can't really do in many languages. So you'd likely have to write 0777 or equivalent explicitly down, making it so much more obvious what a bad idea that is.
Re: Systemd v228 local root exploit
#18v228 is too new for Debian stable. Unstable had a update on feb 11, 2016. Ubuntu never ran with such early version, since their first uploaded version was 229.
If you are on a systemd system, you can check your version with
$ init --version
systemd 231
+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK -SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT -GNUTLS -ACL +XZ -LZ4 +SECCOMP +BLKID -ELFUTILS +KMOD -IDNRe: Systemd v228 local root exploit
#19yeah, awesome, i enjoy this systemD shit show. Linux is so doomed.
You're right. Ever since distros made systemd default, computers all over the world have been catching fire, exploding, shooting jets of lava from their headphone jacks. It's the end times
I think the headphone jack lava is more a pulseaudio bug
Re: Systemd v228 local root exploit
#20Earlier quoted context omitted.
You're right. Ever since distros made systemd default, computers all over the world have been catching fire, exploding, shooting jets of lava from their headphone jacks. It's the end times
I think the headphone jack lava is more a pulseaudio bug
[deleted]