Microsoft finds Linux desktop flaw that gives root to untrusted users

The vulnerability is not in Linux but in systemd. Systemd should be properly understood as an entirely different OS from traditional Linux.

I honestly think this is malicious on Microsoft's part. Ignoring the fact that this is being portrayed as a Linux flaw when it's really a flaw in a project called networkd-dispatcher, the original article seems to suggest that this project is part of systemd-networkd, when it's really just a third party project with no relation. I'm clearly not the only one who thought this, as most commenters seem to have come to the conclusion that this is a systemd project. It's not even packaged by that many distros (just Debian and derivatives) [1]. The developer even said that no one contacted them [2]. This on top of having typical "exploit marketing" (like a catchy name, a big ASCII art banner, and a long blog post with graphics) really can't lead me to a charitable conclusion.

[1] https://repology.org/project/networkd-dispatcher/packages [2] https://arstechnica.com/information-technology/2022/04/micro...

I was hoping Microsoft's own write-up[0] would cover what distro this PoC was based off of since most popular ones using systemd have some kernel level security policy framework (whether apparmor or selinux).

Instead, under the mitigation section of their blog post the focus is on some product known as Microsoft Defender for Endpoint. From my own (naive) understanding the type of exploit described here would violate most sane selinux policies for the networkd binary.

I guess the only way to know for sure is to try exploiting this vuln on my own systems and see what happens.

[0] https://www.microsoft.com/security/blog/2022/04/26/microsoft...

This actually looks like a flaw in systemd than in a desktop environment.