Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Linux udisks flaw lets attackers get root on major Linux distros

bleepingcomputer.com

Post reply on HN
Print view View original

91–100 of 287 posts

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#91

Post by stephenr »

tormeh wrote: post #87
pona-a wrote: post #54

udisks, not counting its dependencies, has 265,334 LoC. pmount, in contrast, has 19,978 LoC, or >13x less. sudo, another setuid binary with a lot of policy code, has 210 CVEs / 430.150 kLoC = ~0.5 CVE per kLoC. 57.5% of CVEs have a CVSS >= 7, so 0.5 * 0.575 = 0.2875 CVE7/kLoC. As a back-of-envelope estimate, udisks: 0.2875 CVE7/kLoC * 265.334 kLoC = ~76.28 critical CVEs; pmount: 0.2875 CVE7/kLoC * 19.9780 kLoC = ~5.7…

Ubuntu is switching to a Rust implementation of sudo: https://www.phoronix.com/news/Ubuntu-25.10-sudo-rs-Default Repo here: https://github.com/trifectatechfoundation/sudo-rs It's permissively licensed, unfortunately. Wonder why. It's not a library. But it ought to improve security in the long run.

> It's permissively licensed, unfortunately.

Well damn that's a shame. I just hate it when people let others use their work in a way they choose, that happens to be less restrictive than my own personal choices.

/s of course.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#92

Post by wesselbindt »

stephenr wrote: post #91
tormeh wrote: post #87

Earlier quoted context omitted.

Ubuntu is switching to a Rust implementation of sudo: https://www.phoronix.com/news/Ubuntu-25.10-sudo-rs-Default Repo here: https://github.com/trifectatechfoundation/sudo-rs It's permissively licensed, unfortunately. Wonder why. It's not a library. But it ought to improve security in the long run.

> It's permissively licensed, unfortunately. Well damn that's a shame. I just hate it when people let others use their work in a way they choose, that happens to be less restrictive than my own personal choices. /s of course.

Given that enshittification is a thing, and embrace extend extinguish is a thing, I'm inclined to agree with you there, without the /s.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#93

Post by bee_rider »

mathverse wrote: post #81
subscribed wrote: post #5

Earlier quoted context omitted.

That's certainly an interesting standpoint. I use both privately and professionally and while I accept that security-wise (even with selinux) they feel lacking , feature-wise they far exceed Windows I use as my other is except in gaming experience. I wish I had something like GrapheneOS on desktops (yes I know about Qubes)

There is https://grsecurity.net/ but it's not free. It's developed by people with much more experience defending against attackers than all of the other projects combined.

Who are they?

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#94

Post by layer8 »

Geezus_42 wrote: post #72
franga2000 wrote: post #29

Earlier quoted context omitted.

Re:"Eternal experiment"... have you seen Windows 11? Or even 10? The devs can't keep their hands off of the thing, changing, breaking and fixing every component every few months.

Adding ADs to every possible surface, finding new ways to obfuscate built-in spyware

Active Directories?

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#95

Post by Xylakant »

tormeh wrote: post #87
pona-a wrote: post #54

udisks, not counting its dependencies, has 265,334 LoC. pmount, in contrast, has 19,978 LoC, or >13x less. sudo, another setuid binary with a lot of policy code, has 210 CVEs / 430.150 kLoC = ~0.5 CVE per kLoC. 57.5% of CVEs have a CVSS >= 7, so 0.5 * 0.575 = 0.2875 CVE7/kLoC. As a back-of-envelope estimate, udisks: 0.2875 CVE7/kLoC * 265.334 kLoC = ~76.28 critical CVEs; pmount: 0.2875 CVE7/kLoC * 19.9780 kLoC = ~5.7…

Ubuntu is switching to a Rust implementation of sudo: https://www.phoronix.com/news/Ubuntu-25.10-sudo-rs-Default Repo here: https://github.com/trifectatechfoundation/sudo-rs It's permissively licensed, unfortunately. Wonder why. It's not a library. But it ought to improve security in the long run.

> It's permissively licensed, unfortunately. Wonder why.

I've been loosely involved in setting this up, so I can say a little: The people that funded the initial work wanted it permissively licensed. My (somethwat informed) conjecture is that they rank making things secure - even in closed source apps that now could take the code - higher than barring closed forks. It also tracks with the Rust ecosystem in general - APL or derivates are very common in that ecosystem.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#96

Post by scheeseman486 »

stephenr wrote: post #91
tormeh wrote: post #87

Earlier quoted context omitted.

Ubuntu is switching to a Rust implementation of sudo: https://www.phoronix.com/news/Ubuntu-25.10-sudo-rs-Default Repo here: https://github.com/trifectatechfoundation/sudo-rs It's permissively licensed, unfortunately. Wonder why. It's not a library. But it ought to improve security in the long run.

> It's permissively licensed, unfortunately. Well damn that's a shame. I just hate it when people let others use their work in a way they choose, that happens to be less restrictive than my own personal choices. /s of course.

Worked out for Linux, which remains a largely open, collaborative ecosystem. Meanwhile all the BSDs are good for are as less-good Linuxes that can be shoved into proprietary products. Google is choking out AOSP, which they can do because of Android's "less restrictive" license.

Copyleft licenses are demonstrably better for open source projects in the long run. We've had enough time to prove that out now.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#97

Post by 1970-01-01 »

Flaw, bug, and security vulnerability are intermixed in the article. This is a mature field. The word choice should be consistent, and it stinks of poor quality when someone chooses to treat them as if they are technically interchangeable problems.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#99

Post by bee_rider »

franga2000 wrote: post #29
hbogert wrote: post #2

As someone who has been using linux quite happily on the desktop for more than 20 years now, I have to say it remains an eternal experiment, feature wise as well as security wise.

Re:"Eternal experiment"... have you seen Windows 11? Or even 10? The devs can't keep their hands off of the thing, changing, breaking and fixing every component every few months.

I don’t think we need to “whatabout” Windows. I don’t think anyone would say they are trying too many experiments… actually, Windows feels like it was mostly made by overworked folks doing the bare minimum to not get fired. No time for experiments or caring.

Re: New Linux udisks flaw lets attackers get root on major Linux distros

#100

Post by p_l »

londons_explore wrote: post #62
lima wrote: post #44

Earlier quoted context omitted.

Chromium OS gets very close, they also have fully-functional VM-based isolation for Linux applications with GPU acceleration. Unfortunately, there's no popular non-Google distro of it.

The fact that Chromium OS has been teetering on the edge of deprecation/merging with Android/Fuchsia for a decade I think has deterred people from building stuff on top of it. It also seems to have a lot of new code every year for very few new features. It's as if they get every new intern to rewrite a bit of the innards, and then next summer another intern rewrites it again.

OTOH, it was used for multiple container-optimized distros by now:

First CoreOS, which forked into Flatcar Linux (now funded by Microsoft) and Fedora CoreOS (rewrite from Gentoo/ChromeOS base to Fedora base), and Google's Container-Optimized System (used heavily in Google Kubernetes Engine).

Post reply on HN