8 ms·

Seems like distros consider it a medium risk because it doesn't involve remote code execution and requires local access. Though it allows local root privilege e

Seems like distros consider it a medium risk because it doesn't involve remote code execution and requires local access. Though it allows local root privilege escalation which is considered high priority. https://ubuntu.com/security/cves/about#priority https://ubuntu.com/security/cves/about#priority > Medium: A significant problem, typically exploitable for many users. Includes network daemon denial of service, cross-site scripting, and gaining user privileges.

oskarkk 5mo ago
Strange that it's not classified as "high", which specifically includes "local root privilege escalations". > High: A significant problem, typically exploitable for nearly all users in a default installation of Ubuntu. Includes serious remote denial of service, local root privilege escalations, local data theft, and data loss.
- amarant 5mo ago
  It is high now, someone at canonical is paying attention it seems
deleted 5mo ago
[deleted]
deleted 5mo ago
[deleted]
mghackerlady 5mo ago
it's not like this couldn't be chained with some other exploit to get remote access to get remote root access which seems like a bit of an issue
daveoc64 5mo ago
Ubuntu seems to have updated the page to say that it's a high priority now.
markhahn 5mo ago
if your model is that linux is just about single-user desktops, this local exploit isn't too bad. or if your model is nothing but DB servers or the like. mystifying to me that shared, multi-user machines are not thought of. for instance, I administer a system with 27k users - people who can login. even if only 1/10,000 of them are curious/malicious/compromised, we (Canadian national research HPC systems) are at risk. yes, this is somewhat uncommon these days, when shell access is not the norm. but consider the very common sort of shared hosting environment: they typically provide something like plesk to interface to shared machines with no particular isolation. can you (as a website owner or 0wner) convince wordpress/etc to drop and execute a script? yep.
- CGamesPlay 5mo ago
  > if your model is that linux is just about single-user desktops, this local exploit isn't too bad. For example, if you have passwordless sudo, you've already got a widely known LPE vulnerability lurking on your system.
  - oviet 5mo ago
    hmm have i missed anything?
    - OvervCW 5mo ago
      Any program on your computer can just run "sudo" to escalate itself.
      - hk__2 5mo ago
        The problem is not the passwordless sudo but running untrusted programs on your computer under your user. They don’t need sudo to steal your SSH keys or inject malicious code in your .bashrc.
  - dwedge 5mo ago
    Only for your user, and it means a keylogger on the system if it gets rooted can't pull your password to try on other machines. Personally I always either login as root or use passwordless sudo.
dwedge 5mo ago
Local access is a bit of a misnomer though, a vulnerable website can be tricked into running a script
- xmcqdpt2 5mo ago
  True but that requires another vulnerability. It's security in depth. You build your server in a way that it doesn't allow remote code execution, and then you run it with an unprivileged user so that if it does allow it, the consequences are limited. And if running arbitrary code is a feature (you are github or whatever) you use VMs.

oskarkk 5mo ago

Strange that it's not classified as "high", which specifically includes "local root privilege escalations". > High: A significant problem, typically exploitable for nearly all users in a default installation of Ubuntu. Includes serious remote denial of service, local root privilege escalations, local data theft, and data loss.

amarant 5mo ago
It is high now, someone at canonical is paying attention it seems

deleted 5mo ago

[deleted]

deleted 5mo ago

[deleted]

mghackerlady 5mo ago

it's not like this couldn't be chained with some other exploit to get remote access to get remote root access which seems like a bit of an issue

daveoc64 5mo ago

Ubuntu seems to have updated the page to say that it's a high priority now.

markhahn 5mo ago

if your model is that linux is just about single-user desktops, this local exploit isn't too bad. or if your model is nothing but DB servers or the like. mystifying to me that shared, multi-user machines are not thought of. for instance, I administer a system with 27k users - people who can login. even if only 1/10,000 of them are curious/malicious/compromised, we (Canadian national research HPC systems) are at risk. yes, this is somewhat uncommon these days, when shell access is not the norm. but consider the very common sort of shared hosting environment: they typically provide something like plesk to interface to shared machines with no particular isolation. can you (as a website owner or 0wner) convince wordpress/etc to drop and execute a script? yep.

CGamesPlay 5mo ago
> if your model is that linux is just about single-user desktops, this local exploit isn't too bad. For example, if you have passwordless sudo, you've already got a widely known LPE vulnerability lurking on your system.
- oviet 5mo ago
  hmm have i missed anything?
  - OvervCW 5mo ago
    Any program on your computer can just run "sudo" to escalate itself.
    - hk__2 5mo ago
      The problem is not the passwordless sudo but running untrusted programs on your computer under your user. They don’t need sudo to steal your SSH keys or inject malicious code in your .bashrc.
- dwedge 5mo ago
  Only for your user, and it means a keylogger on the system if it gets rooted can't pull your password to try on other machines. Personally I always either login as root or use passwordless sudo.

dwedge 5mo ago

Local access is a bit of a misnomer though, a vulnerable website can be tricked into running a script

xmcqdpt2 5mo ago
True but that requires another vulnerability. It's security in depth. You build your server in a way that it doesn't allow remote code execution, and then you run it with an unprivileged user so that if it does allow it, the consequences are limited. And if running arbitrary code is a feature (you are github or whatever) you use VMs.