5 ms·

At some point in my career, I picked up the notion that there an infinite number of local exploits laying around on your average Linux box. Any local user could

At some point in my career, I picked up the notion that there an infinite number of local exploits laying around on your average Linux box. Any local user could find their way to root unless you took extra steps to lock things down. I'm not saying that there are still bash one-liners that give you a root prompt. Just that the "attack surface" of privileged binaries and kernel APIs is so enormous that there must be something to leverage. I don't mean to pick on anything unfairly but I figured a specially crafted filesystem or FUSE command would do the trick quite easily. Is that still the case or am I just old?

deleted 5y ago
[deleted]
kuroguro 5y ago
Not sure about the particular setup you mentioned, but given that there's an LPE published every few months, I wouldn't be surprised. https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/ https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/ https://blog.qualys.com/vulnerabilities-threat-research/2021/07/20/sequoia-a-local-privilege-escalation-vulnerability-in-linuxs-filesystem-layer-cve-2021-33909 https://blog.qualys.com/vulnerabilities-threat-research/2021...