Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Linux udisks flaw lets attackers get root on major Linux distros

bleepingcomputer.com

Post reply on HN
Print view View original

81–90 of 287 posts

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#81

Post by mathverse »

subscribed wrote: post #5
hbogert wrote: post #2

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.

That's certainly an interesting standpoint. I use both privately and professionally and while I accept that security-wise (even with selinux) they feel lacking , feature-wise they far exceed Windows I use as my other is except in gaming experience. I wish I had something like GrapheneOS on desktops (yes I know about Qubes)

There is https://grsecurity.net/ but it's not free. It's developed by people with much more experience defending against attackers than all of the other projects combined.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#83

Post by IlikeKitties »

mathverse wrote: post #80
IlikeKitties wrote: post #10

Earlier quoted context omitted.

> I wish I had something like GrapheneOS on desktops (yes I know about Qubes) SecureBlue and Kicksecure are the closest equivalents.

No the closest alternative is https://grsecurity.net/

Factually wrong from that very site

> grsecurity® is the only drop-in Linux kernel replacement offering high-performance, state-of-the-art exploit prevention against both known and unknown threats.

While secureblue is a full desktop distro (not just a kernel) that integrates key grapheneos hardening tools like their hardened malloc and forks of their hardened chromium and works with flatpak as a base for hardened application deployment.

grsecurity does literally none of that.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#84

Post by NexRebular »

johannes1234321 wrote: post #67
NexRebular wrote: post #51

Earlier quoted context omitted.

> I'm pretty sure, that the BSD family is pretty mature and secure. Not to mention illumos-based systems too.

I ran Open Solaris for a while on my Laptop and it's quite nice. However the lack of support by practically any software vendor made many things a pain. Since then even more stuff went to the Web, but I really I doubt Illumos got any extra traction.

Most of our server infrastructure runs on illumos at $work. SmartOS/Triton handles our "cloud" and OmniOS runs our storage. The linux monoculture problem luckily can still be handled with zones and bhyve, and I do trust illumos developers' competence to deliver good quality secure software a lot more than linux developers' as well.

Now if FreeBSD (or indeed illumos) would get CUDA-support we could stop using linux for GPU nodes too.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#86

Post by [deleted] »

bapak wrote: post #63
pona-a wrote: post #54

udisks, not counting its dependencies, has 265,334 LoC. pmount, in contrast, has 19,978 LoC, or >13x less. sudo, another setuid binary with a lot of policy code, has 210 CVEs / 430.150 kLoC = ~0.5 CVE per kLoC. 57.5% of CVEs have a CVSS >= 7, so 0.5 * 0.575 = 0.2875 CVE7/kLoC. As a back-of-envelope estimate, udisks: 0.2875 CVE7/kLoC * 265.334 kLoC = ~76.28 critical CVEs; pmount: 0.2875 CVE7/kLoC * 19.9780 kLoC = ~5.7…

It's incredible to me that sudo has that many LoC. I'd assume it would just ask the OS to execute something without restrictions, not have any logic to do so itself.

[deleted]

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#87

Post by tormeh »

pona-a wrote: post #54

udisks, not counting its dependencies, has 265,334 LoC. pmount, in contrast, has 19,978 LoC, or >13x less. sudo, another setuid binary with a lot of policy code, has 210 CVEs / 430.150 kLoC = ~0.5 CVE per kLoC. 57.5% of CVEs have a CVSS >= 7, so 0.5 * 0.575 = 0.2875 CVE7/kLoC. As a back-of-envelope estimate, udisks: 0.2875 CVE7/kLoC * 265.334 kLoC = ~76.28 critical CVEs; pmount: 0.2875 CVE7/kLoC * 19.9780 kLoC = ~5.7…

Ubuntu is switching to a Rust implementation of sudo: https://www.phoronix.com/news/Ubuntu-25.10-sudo-rs-Default

Repo here: https://github.com/trifectatechfoundation/sudo-rs

It's permissively licensed, unfortunately. Wonder why. It's not a library. But it ought to improve security in the long run.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#88

Post by commandersaki »

bapak wrote: post #63
pona-a wrote: post #54

udisks, not counting its dependencies, has 265,334 LoC. pmount, in contrast, has 19,978 LoC, or >13x less. sudo, another setuid binary with a lot of policy code, has 210 CVEs / 430.150 kLoC = ~0.5 CVE per kLoC. 57.5% of CVEs have a CVSS >= 7, so 0.5 * 0.575 = 0.2875 CVE7/kLoC. As a back-of-envelope estimate, udisks: 0.2875 CVE7/kLoC * 265.334 kLoC = ~76.28 critical CVEs; pmount: 0.2875 CVE7/kLoC * 19.9780 kLoC = ~5.7…

It's incredible to me that sudo has that many LoC. I'd assume it would just ask the OS to execute something without restrictions, not have any logic to do so itself.

I think it's all the stuff to do with using a shared sudoers across a network of hosts. They could really clean up the language if they removed all of that gunk, as it's not reflective of how sudo is deployed these days.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#89

Post by throw0101b »

NexRebular wrote: post #84
johannes1234321 wrote: post #67

Earlier quoted context omitted.

I ran Open Solaris for a while on my Laptop and it's quite nice. However the lack of support by practically any software vendor made many things a pain. Since then even more stuff went to the Web, but I really I doubt Illumos got any extra traction.

Most of our server infrastructure runs on illumos at $work. SmartOS/Triton handles our "cloud" and OmniOS runs our storage. The linux monoculture problem luckily can still be handled with zones and bhyve, and I do trust illumos developers' competence to deliver good quality secure software a lot more than linux developers' as well. Now if FreeBSD (or indeed illumos) would get CUDA-support we could stop using linux fo…

> Now if FreeBSD (or indeed illumos) would get CUDA-support we could stop using linux for GPU nodes too.

Could you not run Linux CUDA binaries under FreeBSD's Linuxulator?

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#90

Post by ikekkdcjkfke »

bapak wrote: post #63
pona-a wrote: post #54

udisks, not counting its dependencies, has 265,334 LoC. pmount, in contrast, has 19,978 LoC, or >13x less. sudo, another setuid binary with a lot of policy code, has 210 CVEs / 430.150 kLoC = ~0.5 CVE per kLoC. 57.5% of CVEs have a CVSS >= 7, so 0.5 * 0.575 = 0.2875 CVE7/kLoC. As a back-of-envelope estimate, udisks: 0.2875 CVE7/kLoC * 265.334 kLoC = ~76.28 critical CVEs; pmount: 0.2875 CVE7/kLoC * 19.9780 kLoC = ~5.7…

It's incredible to me that sudo has that many LoC. I'd assume it would just ask the OS to execute something without restrictions, not have any logic to do so itself.

Why does anything at all need to be executed without restrictions though
Post reply on HN