4 ms·

Cached mirror - https://webcache.googleusercontent.com/search?q=cache:LwH96Xc7ImUJ:https://www.openwall.com/lists/oss-security/2021/07/20/1+&cd=3&hl=en&ct=clnk&

• vbezhenar 5y ago
  Local root escalation is very common vulnerability. It's almost pointless to expect that attacker will not be able to escalate his privileges given enough time, if he got user account access. One weak layer of defense at most.
• McGlockenshire 5y ago
  Pulling this attack off requires enough access to the machine to either run the unprivileged commands needed to create the exploit condition or to upload a binary/script that runs unprivileged that in turn creates the exploit condition. If the attacker already has that level of unauthorized access, you're already doomed.
  • tptacek 5y ago
    Attacks like this break multitenant computing environments. It's not a threat to your desktop computer or your phone. But it can be a very big deal for hosting environments. It also breaks sandboxing. To whatever extent you're trying to run programs that are somehow jailed, so you can download and run them without worrying about them taking over your system, kernel LPEs break those assurances.
    • samus 5y ago
      Android also uses user accounts (one per app) to enforce its security model. Is that what you refer to with sandboxing?