3 ms·
This is technically an interesting bug, but the implications are very minor. The only situation where this can be exploited is when you allow a user to execute
by hannob 7y ago
This is technically an interesting bug, but the implications are very minor. The only situation where this can be exploited is when you allow a user to execute something as any other users except root. This seems pretty obscure and probably affects only an extremely small number of configurations.
Pretty much all the headlines I saw on this were overstating or stretching the impact.
- stevekemp 7y agoAgreed it is not likely to hit many people in production, but the writeup on the oss-security post, linked to below is a fascinating reminder of deeply buried assumptions buried, that make security hard.
- cracauer 7y agoNo question about the headlines overstating. But I don't think this is a rare situation. For example you can allow a bunch of users to restart and change a buildbot infrastructure (which runs as its own user, not root).
- derekp7 7y agoBut you are giving them access to that specific build user, not "ALL" followed by "!root".