New Linux udisks flaw lets attackers get root on major Linux distros

Post by worthless-trash » Mon, Jun 23, 2025, 8:15 AM UTC

TheDong wrote: post #15

magicalhippo wrote: post #9

Earlier quoted context omitted.

An exploit chain, like combining it with the PAM issue they mentioned in the very same article, affecting Fedora.

The article was about two issues that combine to make a single local-privilege-escalation, so the PAM thing isn't a separate exploit chain, it's just part of getting local root in this vulnerability. What the parent poster meant is that you first need a way to run arbitrary code before local privilege escalation matters, so the exploit chain has to include _something_ that gets you local code execution. I tend to agr…

Post by udev4096 » Mon, Jun 23, 2025, 8:22 AM UTC

subscribed wrote: post #5

hbogert wrote: post #2

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.

That's certainly an interesting standpoint. I use both privately and professionally and while I accept that security-wise (even with selinux) they feel lacking , feature-wise they far exceed Windows I use as my other is except in gaming experience. I wish I had something like GrapheneOS on desktops (yes I know about Qubes)

Post by DaSHacka » Mon, Jun 23, 2025, 8:27 AM UTC

simoncion wrote: post #20

TheDong wrote: post #15

Earlier quoted context omitted.

The article was about two issues that combine to make a single local-privilege-escalation, so the PAM thing isn't a separate exploit chain, it's just part of getting local root in this vulnerability. What the parent poster meant is that you first need a way to run arbitrary code before local privilege escalation matters, so the exploit chain has to include _something_ that gets you local code execution. I tend to agr…

> ...for most modern single-user linux devices, local privilege escalation means almost nothing. I haven't actually looked at the numbers, but I strongly suspect that it's true that the overwhelming majority of single-user Linux devices out there are Android devices. If that's true, then it's my understanding that Android does bother to fairly properly sandbox programs from each other... so an escalation to root woul…

Post by amelius » Mon, Jun 23, 2025, 8:41 AM UTC

hbogert wrote: post #2

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.

Post by franga2000 » Mon, Jun 23, 2025, 8:50 AM UTC

hbogert wrote: post #2

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.